On Fri, Apr 01, 2016 at 12:28:40PM +0200, Pavel Březina wrote:
On 03/31/2016 02:18 PM, Jakub Hrozek wrote:
>Hi,
>
>I prepared a design page for
https://fedorahosted.org/sssd/ticket/2011
>at:
>
https://fedorahosted.org/sssd/wiki/DesignDocs/SysdbFullyQualifiedNames
I know you have already code mostly ready, it would be nice to briefly
describe the main changes in API which devs will need to comprehend.
(Sorry for the late reply, I wanted to massage the branch a bit more)
I pushed the patches to:
https://github.com/jhrozek/sssd/tree/sysdb-creq
make check works and I'm working on testing the LDAP provider now. I also
tried to split the patches between me an Michal so it's clear who worked
on what.
I haven't touched AD or IPA providers at all..the work is progressing a
bit slower than I expected :-/ One important task will also be to
eliminate parsing of the qualified names with nss_parse_name() in the
deamon.
I think the changes are nicely visible if you follow the NSS responder.
When we switch to checking another domain, we again construct a
domain-specific FQDN (domain-specific, because every domain can differ
in case sensitivity, replacing whitespace etc...). Then, in the
provider we only ever use the internal qualified name until we want to
talk to 'outside', typically when we want to construct the filter or
similar.
Do we have any other use case for name alias besides lowercased value? I can
see that the code expects multiple aliases but I don't see any reference to
them as input from ldap data.
Yes, multivalued cn attributes, there you want to be able to request the
user based on all of them.