Of course it should be possible to dig out that information by
grepping logs or by using ldapsearch but with several domains configured
(and in the future trusts and sub-domains also in play) it's getting a bit laborious
to manually construct LDAP queries for each domain or
plunge into cache files to find out information about a user's origin or group
memberships instead of just doing something like
"sss_search -u jdoe", just as Ondrej says.
If a specific action Ondrej suggests wouldn't work with certain types of domains the
tool could just inform the administrator about the
fact that those domains are not included in the results. The administrator could then
decide next steps depending on the situation at
hand, at least all the information possible to retrieve on the client side for the
domains configured would be easily available.
Thanks,
Well, I understand that not all features would be available for all backends, but
to be honest, to me is sssd synonym for a robust
ldap-client - so I imagine sssd would be in a vast majority used with ldap/IPA backend.
As Marko said, "sss_search -u jdoe" would be nice. I also expect it to return
more than what 'getent' does - i.e. things like mail address,
telephone number,... ok these might not be important now, but certainly will be in the
future (imagine sssd being queried by mailing client
or ekiga/pidgin).
Also, having the information about ldap connection state (i.e. sssd running in connected
or disconnected mode) is extremely useful to me as
one the biggest pain with winbind is its cache - you never know which information came
from the authoritative source and which was just
cached & winbind can not bind to any server due to whatever reason.
Ondrej