Of
course it should be possible to dig out that information by
grepping logs or by using ldapsearch but with several domains
configured (and in the future trusts and sub-domains also in play)
it's getting a bit laborious to manually construct LDAP queries
for each domain or plunge into cache files to find out information
about a user's origin or group memberships instead of just doing
something like "sss_search -u jdoe", just as Ondrej says.
If a specific action Ondrej suggests wouldn't work with certain
types of domains the tool could just inform the administrator
about the fact that those domains are not included in the results.
The administrator could then decide next steps depending on the
situation at hand, at least all the information possible to
retrieve on the client side for the domains configured would be
easily available.
Thanks,
Well, I understand that not all features would be available for all
backends, but to be honest, to me is sssd synonym for a robust
ldap-client - so I imagine sssd would be in a vast majority used
with ldap/IPA backend.
As Marko said, "sss_search -u jdoe" would be nice. I also expect it
to return more than what 'getent' does - i.e. things like mail
address, telephone number,... ok these might not be important now,
but certainly will be in the future (imagine sssd being queried by
mailing client or ekiga/pidgin).
Also, having the information about ldap connection state (i.e. sssd
running in connected or disconnected mode) is extremely useful to me
as one the biggest pain with winbind is its cache - you never know
which information came from the authoritative source and which was
just cached & winbind can not bind to any server due to whatever
reason.
Ondrej