FreeIPA&OpenLMI integration use cases

Martin Kosek mkosek at redhat.com
Tue Aug 5 13:47:18 UTC 2014


On 08/05/2014 02:36 PM, John Dennis wrote:
> On 08/05/2014 08:00 AM, Martin Kosek wrote:
>> Thanks to both for information. We indeed do not plan to investigate
>> managing users and IdM components (services, certificates, users,
>> RBAC, OTP, ...) at this point, we mostly care about deployment and
>> deployment status of servers, replicas and clients. From the
>> references above, it seems our best show may be to "invent" the model
>> ourselves, potentially based on available, though not developed
>> existing DMTF models. Martin 
> 
> Fair enough, you just want to deploy IPA via CIM for the moment. But
> don't forget CIM has already defined a structure to represent services
> and more importantly classes of services. The question is are you going
> to try and fit into the model the governing standards body (DMTF) has
> defined or are you going to ignore it and roll your own incompatible
> *proprietary* non-standard implementation.

I think that we should at least try to go the right way and only fall back to
non-standard implementation when we could not go this way.

> Here is a hint for something I had to learn the hard way. The DMTF site
> is remarkably poorly organized. If you're looking for existing classes
> and the profiles that define those classes there isn't an easy way to
> locate them (at least when I was working). So what I did was download
> ALL the mof's and then concatenated them together into a single file I
> could search in a text editor. That allowed me to find a class and also
> to see where it was being used. Once I found a class I was interested in
> I would then go back to the profiles and figure out which profile was
> referencing that class (which usually also gave a detailed explanation
> of the intended usage and how it fit into the larger scheme of things).
> 
> It is a tedious process but after a while you'll begin to realize there
> is a  pattern. You'll also discover at some point someone at least tried
> to define things like authentication services, domain name services,
> credentials, etc. (most of which IPA is). In other words someone has
> previously tried to define a range of objects and more importantly the
> specific service (classes) that provide those objects (i.e. what IPA
> is). Now, whether that's all vapor specifications meant to be ignored or
> not is a question I can't answer. But on the other hand completely
> ignoring the specifications the governing standards body put into place
> that covers our specific technology area might be short sighted. I don't
> know. What I do know is it's really hard to figure out :-)

Hmm, makes sense to me - we should not just blindly implement own models. For
me, it is still difficult to assess and scope how difficult this approach would
be, we will probably simply need to dive in the related models first and see.
Thanks for the tip and reasoning!

Martin


More information about the openlmi-devel mailing list