On Thu, Sep 03, 2009 at 09:35:49AM -0400, Simo Sorce wrote:
On Thu, 2009-09-03 at 09:13 -0400, Simo Sorce wrote:
> On Thu, 2009-09-03 at 14:02 +0200, Sumit Bose wrote:
> > Hi,
> >
> > this patch is work in progress, please do not push it to the master
> > repository.
> >
> > I think it makes sense to introduce meta-options which can set more than
> > on option at once. As an example I have implemented a 'domain-type'
> > option which will set a couple of option for an IPA domain at once. To
> > handle more than one meta-option this patch needs a bit more
> > abstraction, but I would like to get some feedback on the general idea.
>
> The direction seem good, but I wonder if the actual defaults structures
> should be provided by the module we load and not listed in a a common
> file otherwise we cannot let external modules set their defaults ?
Replying to myself, we cannot really do this with a backend because we
parse the configuration files in the monitor, but we could do another
neat thing.
Create an /etc/sssd/defaults directory where we have files like ipa.conf
or ad.conf, etc...
These are ini files that contain the defaults for the specific
domain-type, at startup monitor lists all files in defaults and loads
them to create a set of default domain types.
The nice thing about this approach is that to change a default you don't
need to recompile the application.
example:
[defaults/ipa]
enumerate = false
id-module = ldap
auth-module = krb5
chpass-module = krb5
access-module = ipa
ldapSchema = rfc2307bis
I changed provider into id-module for consistency, we can have them be
aliases and deprecate "provider" or we can keep using provider instead
of domain-type but add an id-module parameter. In this case if provider
does not match a domain type we use it as a default for all *-module
parameters. So that "provider = ldap" is a sort of auto expansion where
id-module = ldap
auth-module = ldap
chpass-module = ldap
access-module = ldap
or simply provide a defaults/ldap.conf file that specifies this
expansion.
Simo.
I really like the idea about the default ini files. Besides that we do
not need to recompile to change the defaults, it also makes the
documentation of the default value a lot easier.
I also would prefer to have id-module instead of provider, but I'm not
sure how much we will break.
bye,
Sumit