Jakub Hrozek <jhrozek(a)redhat.com> writes:
> On 20 Mar 2018, at 13:51, Simo Sorce <simo(a)redhat.com>
wrote:
> On Tue, 2018-03-20 at 12:54 +0100, Jakub Hrozek wrote:
>>> On 13 Mar 2018, at 14:07, Jakub Hrozek <jhrozek(a)redhat.com> wrote:
>>>
>>>> If debuggability is the only issue have you thought about adding
>>>> an option to dump all requests and replies from both the kcm
>>>> frontend socket and the secrets backend sockets into a secure
>>>> debug log file ?
>>>>
>>>> Would that help ?
>>>
>>> - quota reporting. We need to allow admins to show how much of the
>>> space is a UID using. With the REST API, we would have to add
>>> another endpoint (GET /kcm/$UID/quota_max perhaps?) and I don’t
>>> think if at that point it is clean to do this because these
>>> requests can’t be forwarded to Custodia, because Custodia doesn’t
>>> have a way to get the quota, right? Or do you think the quota
>>> reporting can be done by talking to sssd-secrets from some command
>>> line tool directly instead of the REST API?
>
> Yeah, dunno about this, I see the concern. But yeah some command that
> goes directly to the DB (whatever the solution) seem easier to deal
> with anyway, because the KCM interface itself has nothing about
> quotas anyway.
I guess we could extend the KCM protocol, but that would have to be
done in cooperation with MIT upstream.
Also Heimdal upstream, since it's their protocol originally.
Thanks,
--Robbie