[SSSD] Design document - Do not always override home directory with subdomain_homedir value in server mode

Pavel Reichl preichl at redhat.com
Thu May 28 09:23:23 UTC 2015



On 05/28/2015 10:34 AM, Jakub Hrozek wrote:
> On Wed, May 27, 2015 at 08:00:44PM +0200, Pavel Reichl wrote:
>> Hello,
>>
>> please see design page for simple - RFE: Do not always override home
>> directory with subdomain_homedir value in server mode.
>>
>> https://fedorahosted.org/sssd/wiki/DesignDocs/use_AD_homedir
>>
>> **************************************************************************
>> **************************************************************************
>> **************************************************************************
>>
>> = Do not always override home directory with subdomain_homedir value in
>> server mode =
>>
>> Related ticket(s):
>>   * https://fedorahosted.org/sssd/ticket/2583
>>
>> === Problem statement ===
>> Prior to sssd 1.12, we didn't have the ability to read home directory values
>> from AD in AD-IPA trust setups at all. Instead, we always used the
>> `subdomain_homedir` value. We can read custom LDAP values now, but in order
>> to stay backwards-compatible, we kept using the `subdomain_homedir` value.
>>
>> === Use cases ===
>> Users from AD with POSIX attributes want to use individually set value for
>> home directory.
>>
>> === Overview of the solution ===
>> `subdomain_homedir` for SSSD in server mode should support '%o' template
>> expansion (The original home directory retrieved from the identity
>> provider). In case when `subdomain_homedir` would be expanded to an empty
>> string ('subdomain_homedir=%o' and AD user without POSIX attributes) SSSD
>> should not error out but `fallback_homedir` should be utilized instead.
> Are you proposing to change the default of subdomain_homedir from /home/%d/%u
> to /home/%o as well? I think we can do that in a major release if we
> properly document the change, but I think then fallback_homedir in IPA
> server mode should be changed to /home/%d/%u at the same time.
No I'm not proposing such change. But I like it and I can add it do 
design page and implement it.  I would do that in a separate patch so we 
can delay release of this change for a major release as you proposed. 
Does this work for you?
>
> But I think we should think about two scenarios - new installs and upgrades.
> Upgrades shouldn't change, new installs can. Maybe we can file an IPA
> ticket to add subdomain_homedir=/home/%d/%u during an upgrade (or do the
> change ourselves in an upgrade script) ?
I see what you mean, mbasti thinks that it would not be a big problem to 
do on IPA side.
I personally  have no preference here as this is probably my first time 
in this part of SSSD life cycle.
>
> What we would then have is:
>
>      subdomain_homedir   |   POSIX       |   mapping     |
>          new install     | server value  | /home/%d/%u   |
>          upgrade         | /home/%d/%u   | /home/%d/%u   |
>
>> === Implementation details ===
>> * Extend set of attributes returned by `get_object_from_cache()` by
>> SYSDB_HOMEDIR attribute.
>> * Update `apply_subdomain_homedir()`
>>   * to parse AD home dirrctory from ldb_msg
>>   * do not call `store_homedir_of_user()` if value of expanded home directory
>> is an empty string.
>> * Extend interface of `get_subdomain_homedir_of_user()` to accept AD home
>> directory as parameter.
>>
>> === Configuration changes ===
>> No configuration changes are proposed.
> See above
>
>> === How To Test ===
>> 1. On SSSD in server mode
>>   * For AD user with posix attributes set home directory attribute
>>    * in sssd.conf set `subdomain_homedir` option to '%o'
>>    * delete cache and restart SSSD
> We don't need to delete cache, sss_cache is enough here.
Sure, I'll amend it.
>
>>    * call `getent passwd user` and check that home directory reflects value
>> from AD
>>   * For AD user `without` posix attributes
>>    * in sssd.conf set `subdomain_homedir` option to %o and `fallback_homedir`
>> to /home/%u
>>    * delete cache and restart SSSD
>>    * call `getent passwd user` and check that home directory reflects
>> `fallback_homedir`
>> 2. On SSSD acting as IPA client
>>   * Check that results are the same as on SSSD in server mode and that local
>> `fallback_homedir` is ignored
> This is a good point, fallback_homedir is ignored on the clients
> already, right? Since the clients already just use whatever the extom
> plugin sends them and at the moment subdomain_homedir is always sent?
Yes, that's what I see when testing.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel




More information about the sssd-devel mailing list