[SSSD] Updates of sssd-ldap man page

Stephen Gallagher sgallagh at redhat.com
Fri Aug 20 12:06:33 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/20/2010 04:57 AM, Jan Zelený wrote:
> Hello everybody,
> I've done review of sssd-ldap. Since I'm new here, I'd like to post my findings 
> here and consult them before I start posting patches to documentation.
> 
> The review is related to Ticket #601. Besides issue described in there I found 
> several other missing config options and some other inconsistencies:
> 
> ldap_schema is missing supported values AD and IPA, which seem to have the 
> same behavior as RFC2307bis. It would be good to at least mention this and 
> maybe a plan for future.
> 

IPA we should mention, so we can document that as the correct approach
for setting up IPAv1.

We are intentionally not mentioning the AD schema right now, since it's
not fully-functional. (AD's version of memberOf works differently from
IPA's version)

> ldap_search_timeout is missing, but it is present in sssd 1.2.2. It seems it 
> is still used, so I'd like to know what is the plan here (if I should at least 
> put a note about it in documentation or not).

All options that are in use should be in the documentation.

> ldap_network_timeout and ldap_opt_timeout have both default values 6, not 5.
> 

Good catch.

> ldap_access_filter - is ldap even supported as access provider? I tried to find 
> this out for couple hours and it doesn't seem like it. But it is possible I 
> just don't see this in the code. If ldap isn't supported as access provider, 
> I'll mention it in the man page.
> 

Yes, LDAP is supported as an access provider. Take a look at
src/providers/ldap/sdap_access.c

I actually just wrote up how this works in another email thread:
https://fedorahosted.org/pipermail/sssd-devel/2010-August/004399.html

> 
> Then there are some directives, which are missing in the documentation and 
> they seem to be recognized by sssd. Please correct me if I've put in this list 
> directives which aren't recognized and therefore shouldn't be documented.
> 
> ldap_search_timeout
Discussed above

> ldap_user_search_scope
> ldap_group_search_scope
Neither of these are being used in the code. I don't actually see any
value in them either. I propose we remove them entirely.

> ldap_user_search_filter
> ldap_group_search_filter
These options probably have value, and we need to open a ticket to
actually implement them (since they're not in use at present)


> ldap_offline_timeout
> ldap_purge_cache_timeout
These options should be removed. They're handled by generic code, rather
than in the LDAP provider.

> entry_cache_timeout
This attribute is used every time we save user data to the cache. See:
sdap_save_user()

> account_cache_expiration
This attribute is used during the cache cleanup routines in
ldap_id_cleanup.c

> 
> ldap_entry_usn
> ldap_rootdse_last_usn
> 
Both of these are unused, and I must admit to having no idea what
they're for.

> ldap_user_pwd
This is probably useless. SSSD never actually cares what attribute the
password is stored in, since we should never be requesting it. This
option should go away.

> ldap_user_modify_timestamp
> ldap_group_modify_timestamp
These need to be documented. They are used by the enumeration code to
determine whether a user or group entry has been updated.

> ldap_user_shadow_last_change
> ldap_user_shadow_min
> ldap_user_shadow_max
> ldap_user_shadow_warning
> ldap_user_shadow_inactive
> ldap_user_shadow_expire
> ldap_user_shadow_flag
These attributes are used when ldap_pwd_policy=shadow in order to
determine password expiration. They need to be documented.

> ldap_user_krb_last_pwd_change
> ldap_user_krb_password_expiration
> ldap_pwd_attribute
These attributes are used when ldap_pwd_policy=mit_kerberos in order to
determine password expiration. They need to be documented.

> ldap_group_pwd
This option doesn't appear to be used. I think we can remove it with the
same reasoning as with ldap_user_pwd, above.


Thanks for the great work, Jan!

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkxub8kACgkQeiVVYja6o6OSNgCePuDZ0XZdfdYtaEchs7d9olzH
WCUAn3gNKhLUsYmp/b+Ox0ECNElD2QFR
=eDAL
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list