[SSSD] [PATCHES] Add SID related lookups to the NSS responder - part 2

Jakub Hrozek jhrozek at redhat.com
Fri May 3 16:32:52 UTC 2013


On Fri, May 03, 2013 at 05:15:32PM +0300, Alexander Bokovoy wrote:
> On Fri, 03 May 2013, Jakub Hrozek wrote:
> >On Fri, May 03, 2013 at 04:46:58PM +0300, Alexander Bokovoy wrote:
> >>On Thu, 02 May 2013, Sumit Bose wrote:
> >>>On Thu, May 02, 2013 at 07:23:11PM +0200, Jakub Hrozek wrote:
> >>>>On Thu, May 02, 2013 at 04:07:57PM +0200, Sumit Bose wrote:
> >>>>> Hi,
> >>>>>
> >>>>> this is the second series of patches for the SID related lookups. With
> >>>>> these 4 patches, together with the ones send before, the FreeIPA WebUI
> >>>>> can do the SID-to-name lookups as described in
> >>>>> https://fedorahosted.org/freeipa/ticket/3302.
> >>>>>
> >>>>> The patches currently only support IPA subdomain user, i.e. user and
> >>>>> groups from trusted domains. Upcoming patches will add support for IPA
> >>>>> user and support for the AD provider as well.
> >>>>>
> >>>>> bye,
> >>>>> Sumit
> >>>>
> >>>>Seems like the patches need rebasing on top of Pavel's recent patchset..
> >>>
> >>>rebased on current master.
> >>Regarding Python interface I have made few suggestions on IRC which are not
> >>yet present in the proposed patches:
> >>
> >>1. Support tuple in addition to list as arguments. IPA Python code
> >>provides tuples to its methods when an argument is declared as list (+ or * suffix),
> >>to allow position-significant arguments.
> >>
> >>2. Support also Unicode strings and return them by default. Again, IPA
> >>Python code by default deals with Unicode strings in arguments (so, in
> >>upcoming 'trust-resolve' command '--sids' argument will give tuple of
> >>unicode strings to the Python method).
> >>
> >>Additionally, returning unicode strings is important due to the fact
> >>that user/group names are not limited to ASCII. More to that, Windows is
> >>known to localise group and user names to target language, so that for
> >>example, in Russian version a group with RID 498, "enterprise read-only
> >>domain controllers" is actually "Контроллеры домена предприятия — только
> >>чтение".
> >
> >I think we can do these changes post-beta1 though, I would like to
> >include this patchset in the beta1 and according to the conversation we
> >had yesterday on the SSSD meeting, these patches already are enough to
> >make the feature testable.
> True. I'm actually accomodating IPA code to pass normal string and list
> to pysss_nss_idmap right now so there should be no issue. Since I'm
> using getnamebysid(), it is guaranteed that input is never beyond ASCII
> (it is SID, after all) and for the output we can fix it post FreeIPA
> 3.2 before Fedora 19 release.
> 
> 
> >Do you see any problem in filing tickets for the suggestion above? We
> >could then also assign these enhancements to somebody else than Sumit
> >and save his valuable time.
> Absolutely no problem. I'll file tickets.

Alexander filed:
https://fedorahosted.org/sssd/ticket/1905

I sent some smallish changes to Sumit in a private e-mail (it was easier
to do the change locally than to describe on the list), but the patches
are mostly looking good to me.

IIRC the changes only affected patch #2, patches 1,3 and 4 can be acked.

The code builds, tests pass, distcheck and make rpms also work fine. I
will just run a couple of sanity tests now.



More information about the sssd-devel mailing list