On Fri, Jun 20, 2014 at 5:09 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Tue, Mar 04, 2014 at 09:37:51AM +0200, Noam Meltzer wrote:
Hello sssd-devel & linux-nfs,
This is v2 of the patch set. It is now sent to linux-nfs as weel,
following
Steve Dickson request.
The code in the next 5 patches implements the design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
The changes in the code (compared to v1) are following the review done in sssd-devel. I believe that there are still two items in dispute (no final verdict
was given
in the sssd mailing list) but this new patch set will give a chance to
have a
cleaner look on things.
I have a couple of minor suggestions about the patches (mostly style issues), I'm going to reply to the patches themselves. I haven't yet done any testing, just visual review and sanity testing of the patches (make, make check, make distcheck, make rpms)
But more importantly, I wonder what the benefit for an administrator would be over using libnfsidmap/nsswitch.so ? Since the names must be fully qualified the raw getpwnam() interface would yield the same usernames as the sssd module, right? Is it perhaps better multi-domain support ?
The main advantage of this new plugin would be in a NFS server which is not intended for users to log into. Allowing the NSS layer (i.e. the OS, in the common man language) to be aware of users is a potential security risk, and many times not desirable. The direct interface between rpc.idmapd and sssd solves this issue. It allows an administrator *not* to configure the OS to be aware of LDAP/AD users but rather only the NFS component.
- Noam