[SSSD] RFC: Expose different identity domains to different D-BUS consumers

Jakub Hrozek jhrozek at redhat.com
Fri May 22 09:44:28 UTC 2015


On Fri, May 22, 2015 at 11:28:50AM +0200, Pavel Březina wrote:
> On 05/22/2015 11:26 AM, Jakub Hrozek wrote:
> >On Thu, May 21, 2015 at 09:26:28AM -0400, Dmitri Pal wrote:
> >>On 05/21/2015 06:22 AM, Pavel Březina wrote:
> >>>https://fedorahosted.org/sssd/ticket/2187
> >>>
> >>>My idea is as follows:
> >>>
> >>>- create new option 'domains' in [ifp] sections
> >>>- this option can reduce number of domains set in 'domains' in [sssd]
> >>>section
> >>>- provide this reduced domains set to rctx->domains
> >>>
> >>>[sssd]
> >>>domains = A, B, C
> >>>
> >>>[ifp]
> >>>domains = B
> >>>
> >>>rctx->domains would contain only B in ifp responder.
> >>>
> >>>But I am not sure if it fulfills the requirement.
> >>
> >>IMO it should be similar to
> >>https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM but for
> >>IFP.
> >>The design above does not address the requirement.
> >
> >Yes.
> >
> >Long-term, we should really consider polkit instead of just using UIDs
> >in sssd.conf.
> 
> Should I dive into polkit and poc it in ifp?

I say let's first make it useful for Stef's use-case -- IOW make IFP
feature-compatible with AccountService. From the top of my head, we still
need signals, because Cockpit depends on them heavily. Polkit should
come next.

Also please note polkit is on the list of Lennart's software to replace
:-) so before we start using polkit we should check with the systemd
developers if it's a viable option in the long term or if we should just
go with whatever they plan from the start (or both with a compat layer).



More information about the sssd-devel mailing list