[SSSD] [RFC][PATCH] adding domain-type config option
Sumit Bose
sbose at redhat.com
Thu Sep 3 13:46:07 UTC 2009
On Thu, Sep 03, 2009 at 09:35:49AM -0400, Simo Sorce wrote:
> On Thu, 2009-09-03 at 09:13 -0400, Simo Sorce wrote:
> > On Thu, 2009-09-03 at 14:02 +0200, Sumit Bose wrote:
> > > Hi,
> > >
> > > this patch is work in progress, please do not push it to the master
> > > repository.
> > >
> > > I think it makes sense to introduce meta-options which can set more than
> > > on option at once. As an example I have implemented a 'domain-type'
> > > option which will set a couple of option for an IPA domain at once. To
> > > handle more than one meta-option this patch needs a bit more
> > > abstraction, but I would like to get some feedback on the general idea.
> >
> > The direction seem good, but I wonder if the actual defaults structures
> > should be provided by the module we load and not listed in a a common
> > file otherwise we cannot let external modules set their defaults ?
>
> Replying to myself, we cannot really do this with a backend because we
> parse the configuration files in the monitor, but we could do another
> neat thing.
> Create an /etc/sssd/defaults directory where we have files like ipa.conf
> or ad.conf, etc...
> These are ini files that contain the defaults for the specific
> domain-type, at startup monitor lists all files in defaults and loads
> them to create a set of default domain types.
> The nice thing about this approach is that to change a default you don't
> need to recompile the application.
>
> example:
> [defaults/ipa]
> enumerate = false
> id-module = ldap
> auth-module = krb5
> chpass-module = krb5
> access-module = ipa
> ldapSchema = rfc2307bis
>
> I changed provider into id-module for consistency, we can have them be
> aliases and deprecate "provider" or we can keep using provider instead
> of domain-type but add an id-module parameter. In this case if provider
> does not match a domain type we use it as a default for all *-module
> parameters. So that "provider = ldap" is a sort of auto expansion where
> id-module = ldap
> auth-module = ldap
> chpass-module = ldap
> access-module = ldap
>
> or simply provide a defaults/ldap.conf file that specifies this
> expansion.
>
> Simo.
>
I really like the idea about the default ini files. Besides that we do
not need to recompile to change the defaults, it also makes the
documentation of the default value a lot easier.
I also would prefer to have id-module instead of provider, but I'm not
sure how much we will break.
bye,
Sumit
More information about the sssd-devel
mailing list