On Tue, 2012-02-21 at 18:26 +0100, Ondrej Valousek wrote:
Well, I would like to see something like 'adquery' or
'adinfo' from
Centrify - i.e. tool that would:
1. enumerate maps like group, passwd, automount... getent can not do
everything
This only works with AD because there is an alternative RPC-based
mechanism to ask for this information. In the general LDAP case, SSSD
can't get any more information than 'getent' is permitted.
2. Display information about a user (account active, disabled,
locked,...)
This is again not always possible to determine. Most LDAP servers use
server-side policy controls. We basically can't learn this information
until we try to authenticate in many cases.
3. Group membership - how was group membership computed (in ldap we
can have nested groups, not all groups have Unix attributes defined)
This might be a nice feature. Please file an enhancement ticket at
https://fedorahosted.org/sssd
If you need an account, you can get one for free at
https://admin.fedoraproject.org/accounts
4. Status about connection to the domain
(connected/disconnected,...)
+ all details (like ldap controller being connected...)
This isn't really useful information much of the time, because we don't
always maintain a connection(it wastes resources on the server-side).
The most we could give you is whether the last attempt to contact the
server was successful, but this would probably be more misleading than
useful.
5. Version running
https://fedorahosted.org/sssd/ticket/953
This was added in SSSD 1.7.0
In general some too that would help in case of any problems.
Reconfiguring sssd for higher debug level & restarting & inspecting
logs - this all takes a lot of time....
We added the ability to change debug levels without restarting SSSD in
1.7.0:
https://fedorahosted.org/sssd/ticket/950