Ruminations on realmd

Tomáš Smetana tsmetana at redhat.com
Tue Jun 17 06:58:52 UTC 2014


On Fri, 13 Jun 2014 10:01:23 -0400
Stephen Gallagher <sgallagh at redhat.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Today I spent some time playing around with the realmd provider in
> OpenLMI. My specific intent was to see what it might take to be able
> to configure the FreeIPA Domain Controller to be able to enroll
> clients into the domain from the central server (assuming that they
> know an appropriate Pegasus username).
> 
> I put together a RHEL 7 kickstart (attached[1]) containing the minimum
> set of software necessary to use OpenLMI.

Thanks!

<...>

> I think there are several things that we can improve in this flow.
> 
> First of all, I think that if JoinDomain() reports that packages need
> to be installed, it should implicitly invoke the Software provider and
> install them; thus only returning a failure to the caller if the
> packages are unavailable for installation.

I second Jan in this -- silently installing packages is IMO not a good idea.
This may be eventually a goal for a realmd script that could do it.  Not the
provider though.

> Secondly, I think we should consider including 'openlmi-realmd' as one
> of the packages pulled in by the 'openlmi' meta-package.

I have no opinion here.  I admit that I have no idea how usual is it to have
a KRB/AD domain set in the environments OpenLMI is aiming at.

> It would also be useful for the JoinDomain() method to accept an
> optional argument to provide the DNS server address, so a client could
> indicate that the standard DHCP-assigned DNS addresses are not correct
> for this domain.

Again -- isn't this somewhat working around broken network setup? DHCP should
take care of telling its clients what DNS server to use.

> Additionally, I think we should explore the possibility of enhancing
> our OpenSLP attributes such that it would be possible to query SLP for
> "all machines on the network that have the openlmi-realmd provider
> installed and are not currently on a domain (or are currently joined
> to domain X, etc.). This would make it possible for FreeIPA's GUI or
> CLI to present the domain administrator with a list of machines that
> could be joined to the domain.

Hmm... Who should be responsible for telling SLP the machine is not a domain
member?  Realmd or OpenLMI?

> [1] This kickstart is likely incomplete, as it will need to be
> tailored for your environment to be able to access the appropriate RPM
> installation channels. I omitted those from the included kickstart
> because I was using a local mirror.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
> 
> iEYEARECAAYFAlObBDIACgkQeiVVYja6o6NQfgCeIFONeKTBD65OWwWC+czOvxaz
> lKYAoI63bYA7O9waEC0AQ3P9XPN45+JV
> =14Px
> -----END PGP SIGNATURE-----

Regards,
-- 
Tomáš Smetana
Platform Engineering, Red Hat


More information about the openlmi-devel mailing list