On Fri, Jun 20, 2014 at 5:09 PM, Jakub Hrozek <jhrozek(a)redhat.com> wrote:
On Tue, Mar 04, 2014 at 09:37:51AM +0200, Noam Meltzer wrote:
> Hello sssd-devel & linux-nfs,
> This is v2 of the patch set. It is now sent to linux-nfs as weel,
> Steve Dickson request.
> The code in the next 5 patches implements the design document:
> The changes in the code (compared to v1) are following the review done in
> I believe that there are still two items in dispute (no final verdict
> in the sssd mailing list) but this new patch set will give a chance to
> cleaner look on things.
I have a couple of minor suggestions about the patches (mostly style
issues), I'm going to reply to the patches themselves. I haven't yet
done any testing, just visual review and sanity testing of the patches
(make, make check, make distcheck, make rpms)
But more importantly, I wonder what the benefit for an administrator would
be over using libnfsidmap/nsswitch.so ? Since the names must be fully
qualified the raw getpwnam() interface would yield the same usernames as
the sssd module, right? Is it perhaps better multi-domain support ?
The main advantage of this new plugin would be in a NFS server which is
not intended for users to log into.
Allowing the NSS layer (i.e. the OS, in the common man language) to be
aware of users is a potential security risk, and many times not desirable.
The direct interface between rpc.idmapd and sssd solves this issue. It
allows an administrator *not* to configure the OS to be aware of LDAP/AD
users but rather only the NFS component.