[SSSD] Bus-activating the IFP responder by default

Jakub Hrozek jhrozek at redhat.com
Thu Jul 3 10:38:02 UTC 2014


Hi,

at the moment the services (aka responders) that SSSD starts must be listed
explicitly in the 'services' line in the [sssd] section of sssd.conf. For
services like PAM, NSS or even sudo, this is not too problematic, just
inconvenient and we have plans to socket-activate the responders:
https://fedorahosted.org/sssd/ticket/2243

I could swear we also had an option to get rid of the 'services' option
completely but I only found a ticket to get rid of the 'domains':
https://fedorahosted.org/sssd/ticket/2230

For the ifp service, we could do something similar as planned for domains
and take advantage of the bus-activation. Patches that bus-activate the
ifp responder are alrady on review:
https://lists.fedorahosted.org/pipermail/sssd-devel/2014-July/020471.html
But these patches only deal with the case where messagebus was started
before sssd.

We could take advantage of the socket-activation even sooner than we get
to implementing #2243. The proposal was:
    - if 'services' are not specified, use the default list (nss, pam).
      If a request arrived to the system bus, socket-activate ifp
    - if 'services' were specified, treat that as a canonical list and
      don't activate the ifp responder

But my opinion is that we have already quite a lot of work for 1.12 and we
should implement bus-activating the ifp responder together with the socket
activation in 1.13. But if any of the projects that use or plan to use our
DBus API would see adding the 'ifp' to the list of services as problematic,
we should reconsider #2242 for inclusion in 1.12.x

On a related note, the dbus responder is currently packaged in its own
subpackage that is not dragged in when the user yum installs the 'sssd'
meta-package. That's because the sssd-dbus subpackage has some additional
dependencies admins might not like to have installed by default. From
the point of view of users of our DBus service, is this expected and/or
acceptable? Or would it be more expected to have the whole lot after
installing the 'sssd' package?

Thoughts?



More information about the sssd-devel mailing list