-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/20/2010 04:57 AM, Jan Zelený wrote:
Hello everybody,
I've done review of sssd-ldap. Since I'm new here, I'd like to post my
findings
here and consult them before I start posting patches to documentation.
The review is related to Ticket #601. Besides issue described in there I found
several other missing config options and some other inconsistencies:
ldap_schema is missing supported values AD and IPA, which seem to have the
same behavior as RFC2307bis. It would be good to at least mention this and
maybe a plan for future.
IPA we should mention, so we can document that as the correct approach
for setting up IPAv1.
We are intentionally not mentioning the AD schema right now, since it's
not fully-functional. (AD's version of memberOf works differently from
IPA's version)
ldap_search_timeout is missing, but it is present in sssd 1.2.2. It
seems it
is still used, so I'd like to know what is the plan here (if I should at least
put a note about it in documentation or not).
All options that are in use should be in the documentation.
ldap_network_timeout and ldap_opt_timeout have both default values 6,
not 5.
Good catch.
ldap_access_filter - is ldap even supported as access provider? I
tried to find
this out for couple hours and it doesn't seem like it. But it is possible I
just don't see this in the code. If ldap isn't supported as access provider,
I'll mention it in the man page.
Yes, LDAP is supported as an access provider. Take a look at
src/providers/ldap/sdap_access.c
I actually just wrote up how this works in another email thread:
https://fedorahosted.org/pipermail/sssd-devel/2010-August/004399.html
Then there are some directives, which are missing in the documentation and
they seem to be recognized by sssd. Please correct me if I've put in this list
directives which aren't recognized and therefore shouldn't be documented.
ldap_search_timeout
Discussed above
ldap_user_search_scope
ldap_group_search_scope
Neither of these are being used in the code. I don't
actually see any
value in them either. I propose we remove them entirely.
ldap_user_search_filter
ldap_group_search_filter
These options probably have value, and we need to open a
ticket to
actually implement them (since they're not in use at present)
ldap_offline_timeout
ldap_purge_cache_timeout
These options should be removed. They're handled by
generic code, rather
than in the LDAP provider.
entry_cache_timeout
This attribute is used every time we save
user data to the cache. See:
sdap_save_user()
account_cache_expiration
This attribute is used during the
cache cleanup routines in
ldap_id_cleanup.c
ldap_entry_usn
ldap_rootdse_last_usn
Both of these are unused, and I must admit to having no idea what
they're for.
ldap_user_pwd
This is probably useless. SSSD never actually
cares what attribute the
password is stored in, since we should never be requesting it. This
option should go away.
ldap_user_modify_timestamp
ldap_group_modify_timestamp
These need to be documented. They are used by the
enumeration code to
determine whether a user or group entry has been updated.
ldap_user_shadow_last_change
ldap_user_shadow_min
ldap_user_shadow_max
ldap_user_shadow_warning
ldap_user_shadow_inactive
ldap_user_shadow_expire
ldap_user_shadow_flag
These attributes are used when ldap_pwd_policy=shadow in
order to
determine password expiration. They need to be documented.
ldap_user_krb_last_pwd_change
ldap_user_krb_password_expiration
ldap_pwd_attribute
These attributes are used when ldap_pwd_policy=mit_kerberos in
order to
determine password expiration. They need to be documented.
ldap_group_pwd
This option doesn't appear to be used. I
think we can remove it with the
same reasoning as with ldap_user_pwd, above.
Thanks for the great work, Jan!
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAkxub8kACgkQeiVVYja6o6OSNgCePuDZ0XZdfdYtaEchs7d9olzH
WCUAn3gNKhLUsYmp/b+Ox0ECNElD2QFR
=eDAL
-----END PGP SIGNATURE-----