[SSSD] SSSD CIM schema for OpenLMi
Dmitri Pal
dpal at redhat.com
Fri Apr 25 14:19:58 UTC 2014
On 04/25/2014 10:05 AM, Pavel Březina wrote:
> On 04/25/2014 03:17 PM, Dmitri Pal wrote:
>> On 04/25/2014 08:18 AM, Pavel Březina wrote:
>>> Hi,
>>> attached is a CIM schema for SSSD provider. This schema was acked by
>>> OpenLMI developers.
>>>
>>> The first version of OpenLMI provider will provider methods to
>>> enable/disable SSSD components and basic information about domains.
>>>
>>> I hope I don't have to explain the MOF language to developers so I
>>> will just say that association classes models relationships between
>>> other entities. Feel free to ask me anything if needed.
>>>
>>>
>>>
>>> _______________________________________________
>>> sssd-devel mailing list
>>> sssd-devel at lists.fedorahosted.org
>>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>>
>> If I get it right the CIMOM is pretty config file centric. I mean that
>> it tries to create model around the config file and expose its concepts.
>> I do not think this is the right level of abstraction - it is very
>> developer centric.
>> What I had in mind is a more high level abstraction:
>
> From what I have been told, WBEM works a lot differently, than a
> developer experienced in OOP would expect. I have struggled with it
> first, but this is the correct level of abstraction.
>
> WBEM unfortunately is not a technology to be used without a lot of
> knowledge. It took me a while to understand it and learn its concepts,
> they differ from what we are used to.
>
>> * List domains
>
> Listing domains is done by LMI_SSSDDomain.instances() call. Or to get
> for example only domains present in configuration (not subdomains),
> you will use proper association.
OK
>
>> * For each domain get info, or set info.The get will return the details
>> about the domain.
>
> This is done by properties. It is present in the schema.
I saw that
>
> The set will allow to set the type of the domain: AD,
>> IPA, LDAP, LDAP+Kerberos using defaults as much as possible.
>
> Thesis goal was to implement only enabling/disabling domains and
> responders so this is not present in the schema. I will do it if I
> have some spare time or for the next version.
File a ticket once you work lands
>
> Set would
>> also allow turning debugging and enumeration on and off.
>
> This is present in the schema, although not by property set, because
> it requires an SSSD restart and it is important to highlight it in
> this case IMHO. That's why it is present as a method, instead of
> setting a property.
OK, good to know
>
>> * One of the biggest values would be to add secondary domains
>
> What do you mean by secondary domain? If subdomains, they are there.
The other domain other than the one that was initially set by
ipa-client-install or realmd.
There is currently no non manual way to do it AFAIK.
>
>> * Another important aspect is turning on and off the sudo, ssh,
>> automount and SELinux integration.
>
> Present.
Good
>
>> Right now the model seems to be low level and sort of goes from ground
>> up. I would argue that model should expose high level concepts and
>> operations and then be extended to more fine grained operations and
>> object as we need them.
>
> CIM schema should not model of high level concepts. It is a
> representations of managed elements. Not a high level abstraction
> above them. I've tried to go this way first, it was immediately nacked
> by OpenLMI devs and they pushed me to learn WBEM concepts more
> thoroughly.
I would disagree with that but not argue ;-)
>
>> Admin does not care about responders or providers.
>
> Admins should now what they are doing. Therefore they should care. But
> its just about bi-terminology. I had to use responders instead of
> services, because there is already LMI_SSSDService class (by
> convention) representing the daemon.
>
>> Admin cares about the fact that machine is enrolled with a particular
>> domains.
>
> For domain enrolment there is a realmd provider.
Only for the first one.
>
> Tweaking low level concepts would be out of scope of the
>> initial effort.
>>
>> Would have been nice to see the object diagram and discuss it in
>> advance.
>
> UML diagram is attached. I need to figure a way how to model
> associations though.
Thanks! Is there a design page on the wiki or at least going to be?
>
>>
>>
>> --
>> Thank you,
>> Dmitri Pal
>>
>> Sr. Engineering Manager IdM portfolio
>> Red Hat, Inc.
>>
>>
>>
>> _______________________________________________
>> sssd-devel mailing list
>> sssd-devel at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>>
>
>
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140425/3177e3a3/attachment.html>
More information about the sssd-devel
mailing list