FreeIPA&OpenLMI integration use cases

John Dennis jdennis at redhat.com
Tue Aug 5 12:36:21 UTC 2014


On 08/05/2014 08:00 AM, Martin Kosek wrote:
> Thanks to both for information. We indeed do not plan to investigate
> managing users and IdM components (services, certificates, users,
> RBAC, OTP, ...) at this point, we mostly care about deployment and
> deployment status of servers, replicas and clients. From the
> references above, it seems our best show may be to "invent" the model
> ourselves, potentially based on available, though not developed
> existing DMTF models. Martin 

Fair enough, you just want to deploy IPA via CIM for the moment. But
don't forget CIM has already defined a structure to represent services
and more importantly classes of services. The question is are you going
to try and fit into the model the governing standards body (DMTF) has
defined or are you going to ignore it and roll your own incompatible
*proprietary* non-standard implementation.

Here is a hint for something I had to learn the hard way. The DMTF site
is remarkably poorly organized. If you're looking for existing classes
and the profiles that define those classes there isn't an easy way to
locate them (at least when I was working). So what I did was download
ALL the mof's and then concatenated them together into a single file I
could search in a text editor. That allowed me to find a class and also
to see where it was being used. Once I found a class I was interested in
I would then go back to the profiles and figure out which profile was
referencing that class (which usually also gave a detailed explanation
of the intended usage and how it fit into the larger scheme of things).

It is a tedious process but after a while you'll begin to realize there
is a  pattern. You'll also discover at some point someone at least tried
to define things like authentication services, domain name services,
credentials, etc. (most of which IPA is). In other words someone has
previously tried to define a range of objects and more importantly the
specific service (classes) that provide those objects (i.e. what IPA
is). Now, whether that's all vapor specifications meant to be ignored or
not is a question I can't answer. But on the other hand completely
ignoring the specifications the governing standards body put into place
that covers our specific technology area might be short sighted. I don't
know. What I do know is it's really hard to figure out :-)



-- 
John



More information about the openlmi-devel mailing list