[SSSD] Design document - Do not always override home directory with subdomain_homedir value in server mode

Sumit Bose sbose at redhat.com
Thu May 28 10:37:34 UTC 2015


On Thu, May 28, 2015 at 12:04:31PM +0200, Jakub Hrozek wrote:
> On Thu, May 28, 2015 at 11:50:15AM +0200, Sumit Bose wrote:
> > On Thu, May 28, 2015 at 11:30:34AM +0200, Jakub Hrozek wrote:
> > > On Thu, May 28, 2015 at 11:23:23AM +0200, Pavel Reichl wrote:
> > > > 
> > > > 
> > > > On 05/28/2015 10:34 AM, Jakub Hrozek wrote:
> > > > >On Wed, May 27, 2015 at 08:00:44PM +0200, Pavel Reichl wrote:
> > > > >>Hello,
> > > > >>
> > > > >>please see design page for simple - RFE: Do not always override home
> > > > >>directory with subdomain_homedir value in server mode.
> > > > >>
> > > > >>https://fedorahosted.org/sssd/wiki/DesignDocs/use_AD_homedir
> > > > >>
> > > > >>**************************************************************************
> > > > >>**************************************************************************
> > > > >>**************************************************************************
> > > > >>
> > > > >>= Do not always override home directory with subdomain_homedir value in
> > > > >>server mode =
> > > > >>
> > > > >>Related ticket(s):
> > > > >>  * https://fedorahosted.org/sssd/ticket/2583
> > > > >>
> > > > >>=== Problem statement ===
> > > > >>Prior to sssd 1.12, we didn't have the ability to read home directory values
> > > > >>from AD in AD-IPA trust setups at all. Instead, we always used the
> > > > >>`subdomain_homedir` value. We can read custom LDAP values now, but in order
> > > > >>to stay backwards-compatible, we kept using the `subdomain_homedir` value.
> > > > >>
> > > > >>=== Use cases ===
> > > > >>Users from AD with POSIX attributes want to use individually set value for
> > > > >>home directory.
> > > > >>
> > > > >>=== Overview of the solution ===
> > > > >>`subdomain_homedir` for SSSD in server mode should support '%o' template
> > > > >>expansion (The original home directory retrieved from the identity
> > > > >>provider). In case when `subdomain_homedir` would be expanded to an empty
> > > > >>string ('subdomain_homedir=%o' and AD user without POSIX attributes) SSSD
> > > > >>should not error out but `fallback_homedir` should be utilized instead.
> > > > >Are you proposing to change the default of subdomain_homedir from /home/%d/%u
> > > > >to /home/%o as well? I think we can do that in a major release if we
> > > > >properly document the change, but I think then fallback_homedir in IPA
> > > > >server mode should be changed to /home/%d/%u at the same time.
> > > > No I'm not proposing such change. But I like it and I can add it do design
> > > > page and implement it.
> > > 
> > > Let's discuss it on the meeting today (and then circle back to the list
> > > so everything is recorded)
> > 
> > As long as this only relates to SSSD in ipa-server-mode we can use the
> > type of the idranges to switch the default of subdomain_homedir?
> 
> Good idea.
> 
> Do you also agree that on upgrades, we should add:
>     subdomain_homedir = /home/%d/%u

as along as we change the defaults we have to do something like this
during rpm upgrade. Maybe we should carry the discussion about sensible
defaults for a new major SSSD release to freeipa-users as well?

bye,
Sumit

> 
> To be backwards-compatible? Users can then just uncomment the value to
> get POSIX attributes from LDAP..
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list