[SSSD] [RFC][PATCH] adding domain-type config option

Dmitri Pal dpal at redhat.com
Thu Sep 3 14:50:39 UTC 2009


Sumit Bose wrote:
> On Thu, Sep 03, 2009 at 09:35:49AM -0400, Simo Sorce wrote:
>   
>> On Thu, 2009-09-03 at 09:13 -0400, Simo Sorce wrote:
>>     
>>> On Thu, 2009-09-03 at 14:02 +0200, Sumit Bose wrote:
>>>       
>>>> Hi,
>>>>
>>>> this patch is work in progress, please do not push it to the master
>>>> repository.
>>>>
>>>> I think it makes sense to introduce meta-options which can set more than
>>>> on option at once. As an example I have implemented a 'domain-type'
>>>> option which will set a couple of option for an IPA domain at once. To
>>>> handle more than one meta-option this patch needs a bit more
>>>> abstraction, but I would like to get some feedback on the general idea.
>>>>         
>>> The direction seem good, but I wonder if the actual defaults structures
>>> should be provided by the module we load and not listed in a a common
>>> file otherwise we cannot let external modules set their defaults ?
>>>       
>> Replying to myself, we cannot really do this with a backend because we
>> parse the configuration files in the monitor, but we could do another
>> neat thing.
>> Create an /etc/sssd/defaults directory where we have files like ipa.conf
>> or ad.conf, etc...
>> These are ini files that contain the defaults for the specific
>> domain-type, at startup monitor lists all files in defaults and loads
>> them to create a set of default domain types.
>> The nice thing about this approach is that to change a default you don't
>> need to recompile the application.
>>
>> example:
>> [defaults/ipa]
>>   enumerate = false
>>   id-module = ldap
>>   auth-module = krb5
>>   chpass-module = krb5
>>   access-module = ipa
>>   ldapSchema = rfc2307bis
>>
>> I changed provider into id-module for consistency, we can have them be
>> aliases and deprecate "provider" or we can keep using provider instead
>> of domain-type but add an id-module parameter. In this case if provider
>> does not match a domain type we use it as a default for all *-module
>> parameters. So that "provider = ldap" is a sort of auto expansion where
>> id-module = ldap
>> auth-module = ldap
>> chpass-module = ldap
>> access-module = ldap
>>
>> or simply provide a defaults/ldap.conf file that specifies this
>> expansion.
>>
>> Simo.
>>
>>     
>
> I really like the idea about the default ini files. Besides that we do
> not need to recompile to change the defaults, it also makes the
> documentation of the default value a lot easier.
>
> I also would prefer to have id-module instead of provider, but I'm not
> sure how much we will break.
>
> bye,
> Sumit
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
>   
I really do not have any preferences about this as long as my concerns that
we discussed with Steve (those that he found valid) are addressed.
Separate ini file might add more complexity than needed to what
he is currently working on and preparing to propose.
But may be there is a way to reconcile the two.

-- 
Thank you,
Dmitri Pal

Engineering Manager IPA project,
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/




More information about the sssd-devel mailing list