[SSSD] Design document - Do not always override home directory with subdomain_homedir value in server mode

Pavel Reichl preichl at redhat.com
Thu May 28 11:59:49 UTC 2015



On 05/28/2015 01:24 PM, Jakub Hrozek wrote:
> On Thu, May 28, 2015 at 12:37:34PM +0200, Sumit Bose wrote:
>> On Thu, May 28, 2015 at 12:04:31PM +0200, Jakub Hrozek wrote:
>>> On Thu, May 28, 2015 at 11:50:15AM +0200, Sumit Bose wrote:
>>>> On Thu, May 28, 2015 at 11:30:34AM +0200, Jakub Hrozek wrote:
>>>>> On Thu, May 28, 2015 at 11:23:23AM +0200, Pavel Reichl wrote:
>>>>>>
>>>>>> On 05/28/2015 10:34 AM, Jakub Hrozek wrote:
>>>>>>> On Wed, May 27, 2015 at 08:00:44PM +0200, Pavel Reichl wrote:
>>>>>>>> Hello,
>>>>>>>>
>>>>>>>> please see design page for simple - RFE: Do not always override home
>>>>>>>> directory with subdomain_homedir value in server mode.
>>>>>>>>
>>>>>>>> https://fedorahosted.org/sssd/wiki/DesignDocs/use_AD_homedir
>>>>>>>>
>>>>>>>> **************************************************************************
>>>>>>>> **************************************************************************
>>>>>>>> **************************************************************************
>>>>>>>>
>>>>>>>> = Do not always override home directory with subdomain_homedir value in
>>>>>>>> server mode =
>>>>>>>>
>>>>>>>> Related ticket(s):
>>>>>>>>   * https://fedorahosted.org/sssd/ticket/2583
>>>>>>>>
>>>>>>>> === Problem statement ===
>>>>>>>> Prior to sssd 1.12, we didn't have the ability to read home directory values
>>>>>>> >from AD in AD-IPA trust setups at all. Instead, we always used the
>>>>>>>> `subdomain_homedir` value. We can read custom LDAP values now, but in order
>>>>>>>> to stay backwards-compatible, we kept using the `subdomain_homedir` value.
>>>>>>>>
>>>>>>>> === Use cases ===
>>>>>>>> Users from AD with POSIX attributes want to use individually set value for
>>>>>>>> home directory.
>>>>>>>>
>>>>>>>> === Overview of the solution ===
>>>>>>>> `subdomain_homedir` for SSSD in server mode should support '%o' template
>>>>>>>> expansion (The original home directory retrieved from the identity
>>>>>>>> provider). In case when `subdomain_homedir` would be expanded to an empty
>>>>>>>> string ('subdomain_homedir=%o' and AD user without POSIX attributes) SSSD
>>>>>>>> should not error out but `fallback_homedir` should be utilized instead.
>>>>>>> Are you proposing to change the default of subdomain_homedir from /home/%d/%u
>>>>>>> to /home/%o as well? I think we can do that in a major release if we
>>>>>>> properly document the change, but I think then fallback_homedir in IPA
>>>>>>> server mode should be changed to /home/%d/%u at the same time.
>>>>>> No I'm not proposing such change. But I like it and I can add it do design
>>>>>> page and implement it.
>>>>> Let's discuss it on the meeting today (and then circle back to the list
>>>>> so everything is recorded)
>>>> As long as this only relates to SSSD in ipa-server-mode we can use the
>>>> type of the idranges to switch the default of subdomain_homedir?
>>> Good idea.
>>>
>>> Do you also agree that on upgrades, we should add:
>>>      subdomain_homedir = /home/%d/%u
>> as along as we change the defaults we have to do something like this
>> during rpm upgrade. Maybe we should carry the discussion about sensible
>> defaults for a new major SSSD release to freeipa-users as well?
> Yes, Pavel, can you start the thread since you own the ticket?
Thread with subject 'Sensible defaults for a new major SSSD release' has 
been started on  freeipa-users.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel




More information about the sssd-devel mailing list