FreeIPA&OpenLMI integration use cases

Martin Kosek mkosek at redhat.com
Tue Aug 5 12:00:08 UTC 2014


On 08/05/2014 09:28 AM, Jan Safranek wrote:
> On 08/04/2014 09:11 PM, John Dennis wrote:
>> On 08/04/2014 07:48 AM, Jan Safranek wrote:
>>> On 07/30/2014 02:42 PM, Martin Kosek wrote:
>>>> This is the main set of use cases, we will be looking forward to your
>>>> recommendation on how to address them with OpenLMI. We would be also interested
>>>> whether you would recommend designing&implementing simply via our own CIM
>>>> model, not integrated in DMTF ecosystem (i.e. mostly just implementing RPC
>>>> interface) or rather going the hard way and follow the DMTF models and profiles?
>>> DMTF does not say anything about AD or Kerberos server management. I
>>> would recommend to write your own models and make them as close to
>>> underlying implementation (DBus API or IPA libraries) as possible.
>>>
>>> If CIM is just a protocol between various IPA components (e.g. GUI
>>> talking to remote IPA installation to turn itself to be a replica), it
>>> may be even proprietary, not documented and unstable. And it does not
>>> need to be CIM at all.
>>>
>>> if CIM is used as public remote API to manage IPA, it _should_ be stable
>>> and somewhat generic to allow future modifications without breaking
>>> existing users of the API, but you know, sometimes is the best just to
>>> break the API. CIM allows versioning, so the client can check what
>>> version of the API remote server supports and adapt accordingly.
>>>
>>>> [2]
>>>> http://www.openlmi.org/sites/default/files/doc/admin/openlmi-providers/0.4.2/realmd/index.html
>>
>> I don't agree that DTMF has nothing to say about Kerberos nor for that
>> matter the type of things that IPA does. In 5 minutes of googling I came
>> up with these, they are a reasonable starting point for further
>> investigation concerning existing CIM models that would impact an IPA
>> server and clients. I know there are more models that are relevant
>> because I found them when I was researching in preparation for the
>> realmd provider, this is just what I could find in a couple of minutes.
>>
>> CIM_KerberosKeyDistributionCenter
>> http://wbemservices.sourceforge.net/moftree/schema/CIM_KerberosKeyDistributionCenter.html
>>
>> CIM_KerberosCredential
>> http://schemas.dmtf.org/wbem/cim-html/2.39.0+/CIM_KerberosCredential.html
>>
> 
> Well, yes, there are some classes that describe KDC & Kerberos ticket,
> but there is no profile for it, it seems abandoned. Look at them and you
> can reuse them if you find them appropriate, but it won't make you
> interoperable with others in any way.
> 
>> CIM_Identity
>> http://schemas.dmtf.org/wbem/cim-html/2/CIM_Identity.html
>>
>> Simple Identity Management Profile
>> http://www.dmtf.org/sites/default/files/standards/documents/DSP1034_1.1.0.pdf
>>
>> Role Based Authorization Profile
>> http://www.dmtf.org/sites/default/files/standards/documents/DSP1039_1.0.0.pdf
>>
>> Certificate Management Profile
>> http://www.dmtf.org/sites/default/files/standards/documents/DSP1096_1.0.0.pdf
>>
>> Integrated Access and Control Policy Management Profile
>> http://www.dmtf.org/sites/default/files/standards/documents/DSP1106_1.0.0_0.pdf
>>
> 
> These are profiles to describe users, groups, roles and policies. I got
> an impression that we're managing IPA server itself and not users and
> policies stored in it.
> 
>> Dell Active Directory Client Profile
>> http://media.community.dell.com/en/dtc/attach/dcim-
>> active_directory_client_profile-1.0.pdf
> 
> This is Dell proprietary profile.
> 
> Jan

Thanks to both for information. We indeed do not plan to investigate managing
users and IdM components (services, certificates, users, RBAC, OTP, ...) at
this point, we mostly care about deployment and deployment status of servers,
replicas and clients.

>From the references above, it seems our best show may be to "invent" the model
ourselves, potentially based on available, though not developed existing DMTF
models.

Martin


More information about the openlmi-devel mailing list