On 05/28/2015 10:34 AM, Jakub Hrozek wrote:
On Wed, May 27, 2015 at 08:00:44PM +0200, Pavel Reichl wrote:
> Hello,
>
> please see design page for simple - RFE: Do not always override home
> directory with subdomain_homedir value in server mode.
>
>
https://fedorahosted.org/sssd/wiki/DesignDocs/use_AD_homedir
>
> **************************************************************************
> **************************************************************************
> **************************************************************************
>
> = Do not always override home directory with subdomain_homedir value in
> server mode =
>
> Related ticket(s):
> *
https://fedorahosted.org/sssd/ticket/2583
>
> === Problem statement ===
> Prior to sssd 1.12, we didn't have the ability to read home directory values
> from AD in AD-IPA trust setups at all. Instead, we always used the
> `subdomain_homedir` value. We can read custom LDAP values now, but in order
> to stay backwards-compatible, we kept using the `subdomain_homedir` value.
>
> === Use cases ===
> Users from AD with POSIX attributes want to use individually set value for
> home directory.
>
> === Overview of the solution ===
> `subdomain_homedir` for SSSD in server mode should support '%o' template
> expansion (The original home directory retrieved from the identity
> provider). In case when `subdomain_homedir` would be expanded to an empty
> string ('subdomain_homedir=%o' and AD user without POSIX attributes) SSSD
> should not error out but `fallback_homedir` should be utilized instead.
Are you proposing to change the default of subdomain_homedir from /home/%d/%u
to /home/%o as well? I think we can do that in a major release if we
properly document the change, but I think then fallback_homedir in IPA
server mode should be changed to /home/%d/%u at the same time.
No I'm not
proposing such change. But I like it and I can add it do
design page and implement it. I would do that in a separate patch so we
can delay release of this change for a major release as you proposed.
Does this work for you?
But I think we should think about two scenarios - new installs and upgrades.
Upgrades shouldn't change, new installs can. Maybe we can file an IPA
ticket to add subdomain_homedir=/home/%d/%u during an upgrade (or do the
change ourselves in an upgrade script) ?
I see what you mean, mbasti thinks that it
would not be a big problem to
do on IPA side.
I personally have no preference here as this is probably my first time
in this part of SSSD life cycle.
What we would then have is:
subdomain_homedir | POSIX | mapping |
new install | server value | /home/%d/%u |
upgrade | /home/%d/%u | /home/%d/%u |
> === Implementation details ===
> * Extend set of attributes returned by `get_object_from_cache()` by
> SYSDB_HOMEDIR attribute.
> * Update `apply_subdomain_homedir()`
> * to parse AD home dirrctory from ldb_msg
> * do not call `store_homedir_of_user()` if value of expanded home directory
> is an empty string.
> * Extend interface of `get_subdomain_homedir_of_user()` to accept AD home
> directory as parameter.
>
> === Configuration changes ===
> No configuration changes are proposed.
See above
> === How To Test ===
> 1. On SSSD in server mode
> * For AD user with posix attributes set home directory attribute
> * in sssd.conf set `subdomain_homedir` option to '%o'
> * delete cache and restart SSSD
We don't need to delete cache, sss_cache is enough here.
Sure, I'll amend
it.
> * call `getent passwd user` and check that home directory reflects value
> from AD
> * For AD user `without` posix attributes
> * in sssd.conf set `subdomain_homedir` option to %o and `fallback_homedir`
> to /home/%u
> * delete cache and restart SSSD
> * call `getent passwd user` and check that home directory reflects
> `fallback_homedir`
> 2. On SSSD acting as IPA client
> * Check that results are the same as on SSSD in server mode and that local
> `fallback_homedir` is ignored
This is a good point, fallback_homedir is ignored on the clients
already, right? Since the clients already just use whatever the extom
plugin sends them and at the moment subdomain_homedir is always sent?
Yes,
that's what I see when testing.
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel