[SSSD] [RFC][PATCH] adding domain-type config option

Sumit Bose sbose at redhat.com
Thu Sep 3 13:46:07 UTC 2009


On Thu, Sep 03, 2009 at 09:35:49AM -0400, Simo Sorce wrote:
> On Thu, 2009-09-03 at 09:13 -0400, Simo Sorce wrote:
> > On Thu, 2009-09-03 at 14:02 +0200, Sumit Bose wrote:
> > > Hi,
> > > 
> > > this patch is work in progress, please do not push it to the master
> > > repository.
> > > 
> > > I think it makes sense to introduce meta-options which can set more than
> > > on option at once. As an example I have implemented a 'domain-type'
> > > option which will set a couple of option for an IPA domain at once. To
> > > handle more than one meta-option this patch needs a bit more
> > > abstraction, but I would like to get some feedback on the general idea.
> > 
> > The direction seem good, but I wonder if the actual defaults structures
> > should be provided by the module we load and not listed in a a common
> > file otherwise we cannot let external modules set their defaults ?
> 
> Replying to myself, we cannot really do this with a backend because we
> parse the configuration files in the monitor, but we could do another
> neat thing.
> Create an /etc/sssd/defaults directory where we have files like ipa.conf
> or ad.conf, etc...
> These are ini files that contain the defaults for the specific
> domain-type, at startup monitor lists all files in defaults and loads
> them to create a set of default domain types.
> The nice thing about this approach is that to change a default you don't
> need to recompile the application.
> 
> example:
> [defaults/ipa]
>   enumerate = false
>   id-module = ldap
>   auth-module = krb5
>   chpass-module = krb5
>   access-module = ipa
>   ldapSchema = rfc2307bis
> 
> I changed provider into id-module for consistency, we can have them be
> aliases and deprecate "provider" or we can keep using provider instead
> of domain-type but add an id-module parameter. In this case if provider
> does not match a domain type we use it as a default for all *-module
> parameters. So that "provider = ldap" is a sort of auto expansion where
> id-module = ldap
> auth-module = ldap
> chpass-module = ldap
> access-module = ldap
> 
> or simply provide a defaults/ldap.conf file that specifies this
> expansion.
> 
> Simo.
> 

I really like the idea about the default ini files. Besides that we do
not need to recompile to change the defaults, it also makes the
documentation of the default value a lot easier.

I also would prefer to have id-module instead of provider, but I'm not
sure how much we will break.

bye,
Sumit




More information about the sssd-devel mailing list