[SSSD] [PATCHES] Always store home directory expansions to sysdb

Lukas Slebodnik lslebodn at redhat.com
Mon Apr 7 18:47:25 UTC 2014


On (07/04/14 20:37), Jakub Hrozek wrote:
>On Mon, Apr 07, 2014 at 08:23:58PM +0200, Lukas Slebodnik wrote:
>> On (04/04/14 19:39), Pavel Reichl wrote:
>> >Hello,
>> >
>> >attached patches implement ticket:
>> >
>> >https://fedorahosted.org/sssd/ticket/2205
>> >
>> >Maybe I split the changes into too many patches, please feel free to
>> >suggest squashing them.
>> >
>> >Regards,
>> >
>> >Pavel Reichl
>> 
>> 
>> I think there is a conflict in requirements between tickets
>>     * #2205 Always store home directory expansions to sysdb
>>     * #1853 [RFE] Allow sssd to replace macro (ie. %H) with value specified in
>>             config file
>> 
>> Lets imagine situation.
>> You have stored homedir template in LDAP server
>>     dn: uid=sshuser,cn=users,<domain>
>>         homeDirectory: %H/sshuser01
>> 
>> In sssd.conf you will have
>> homedir_substring = /export/home
>> 
>> 1. Initial request will expand homedir to string "/export/home/sshuser01".
>> 2. you decided to change homedir_substring to another value e.g. "/home"
>> 3. homedir will return old value, because sysdb cache contains expanded value
>>    and no template.
>> 
>> -- In offline mode, sssd will not return correct values after changing
>>    value of option homedir_substring because template is stored only in server.
>> -- it can be confusing for users that old homedir is returned after changing
>>    value of option homedir_substring. (cached values)
>> -- there will be a workaround (invalidating sysdb cache); but I would say
>>    it will not be intuitive.
>
>This just needs to be documented well in the man pages. We need to say
>that changing this option mandates invalidating the cache. Many options
>do, I don't think this will be suprising for the users.
yes, it is solution. but it will be confusing.
We have how-to for configuring sudo in manual page sssd-sudo
but nobody reads it. It will be the same issue.

I don't like adding unintuitive behaviuor to sssd; but on the other hand
"homedir_substring" needn't be used very often.

BTW if the *only* use case for "storing home directory expansions into sysdb"
is krb5 ccname template then it will be easier to do expansion of homedir in
krb5 code.

LS



More information about the sssd-devel mailing list