[SSSD] [PATCHES] Add SID related lookups to the NSS responder - part 2

Alexander Bokovoy abokovoy at redhat.com
Fri May 3 14:15:32 UTC 2013


On Fri, 03 May 2013, Jakub Hrozek wrote:
>On Fri, May 03, 2013 at 04:46:58PM +0300, Alexander Bokovoy wrote:
>> On Thu, 02 May 2013, Sumit Bose wrote:
>> >On Thu, May 02, 2013 at 07:23:11PM +0200, Jakub Hrozek wrote:
>> >>On Thu, May 02, 2013 at 04:07:57PM +0200, Sumit Bose wrote:
>> >>> Hi,
>> >>>
>> >>> this is the second series of patches for the SID related lookups. With
>> >>> these 4 patches, together with the ones send before, the FreeIPA WebUI
>> >>> can do the SID-to-name lookups as described in
>> >>> https://fedorahosted.org/freeipa/ticket/3302.
>> >>>
>> >>> The patches currently only support IPA subdomain user, i.e. user and
>> >>> groups from trusted domains. Upcoming patches will add support for IPA
>> >>> user and support for the AD provider as well.
>> >>>
>> >>> bye,
>> >>> Sumit
>> >>
>> >>Seems like the patches need rebasing on top of Pavel's recent patchset..
>> >
>> >rebased on current master.
>> Regarding Python interface I have made few suggestions on IRC which are not
>> yet present in the proposed patches:
>>
>> 1. Support tuple in addition to list as arguments. IPA Python code
>> provides tuples to its methods when an argument is declared as list (+ or * suffix),
>> to allow position-significant arguments.
>>
>> 2. Support also Unicode strings and return them by default. Again, IPA
>> Python code by default deals with Unicode strings in arguments (so, in
>> upcoming 'trust-resolve' command '--sids' argument will give tuple of
>> unicode strings to the Python method).
>>
>> Additionally, returning unicode strings is important due to the fact
>> that user/group names are not limited to ASCII. More to that, Windows is
>> known to localise group and user names to target language, so that for
>> example, in Russian version a group with RID 498, "enterprise read-only
>> domain controllers" is actually "Контроллеры домена предприятия — только
>> чтение".
>
>I think we can do these changes post-beta1 though, I would like to
>include this patchset in the beta1 and according to the conversation we
>had yesterday on the SSSD meeting, these patches already are enough to
>make the feature testable.
True. I'm actually accomodating IPA code to pass normal string and list
to pysss_nss_idmap right now so there should be no issue. Since I'm
using getnamebysid(), it is guaranteed that input is never beyond ASCII
(it is SID, after all) and for the output we can fix it post FreeIPA
3.2 before Fedora 19 release.


>Do you see any problem in filing tickets for the suggestion above? We
>could then also assign these enhancements to somebody else than Sumit
>and save his valuable time.
Absolutely no problem. I'll file tickets.

-- 
/ Alexander Bokovoy



More information about the sssd-devel mailing list