On 05/23/2014 10:13 AM, Petr Viktorin wrote:
On 05/23/2014 08:33 AM, Martin Kosek wrote:On 05/23/2014 07:48 AM, Jan Cholasta wrote:On 22.5.2014 19:27, Simo Sorce wrote:On Thu, 2014-05-22 at 15:35 +0200, Martin Kosek wrote:On 05/21/2014 10:11 PM, Dmitri Pal wrote:On 05/21/2014 03:06 PM, Martin Kosek wrote:On 05/21/2014 08:14 PM, Simo Sorce wrote:On Wed, 2014-05-21 at 16:01 +0200, thierry bordaz wrote:Hello,Thanks for all these detailed descriptions.Just to be sure to be on the same page, here is my understanding ofthe provisioning templates and placeholder definitions. Anadministrator can provide a provisioning template. I suppose it would be a file containing a lines of placeholder definitions.* Where is located the template file ? Is there a standardrepository where templates are put ? (somewhere under /etc/ipa/* ?)FreeIPA is a multi-master system, a file stored in a file would beextremely cumbersome to use as it would require the admin to manuallycopy it for every new replica and then keep it in sync. It would also make it hard to change 'on-line'. Placeholders should be defined in an object similar to cn=ipaConfig,cn=etc,$suffix* Is there an already defined syntax for the provisionning template. ('$' is separator attr/value, %{<attr>} is substitute pattern...). If not, is it possible to user ':<space> ' asseparator ?Using initial and final ? like in Martin's example doesn't work ?* What is the priority. The user can provide the 'homeDirectory' through different methods. Is it ok to use the following order:o the CLI option o the provisionning templateo the default config value (in cn=ipaConfig,cn=etc,$SUFFIX)For example, if it exists the provisioning template: /etc/ipa/provisioning/shell-user.template roomnumber$-2 homeDirectory$/home/net/shell-%{uid} loginShell$?shell-plugin-autogenerate?I do not understand this, we are not building a templating engine here,you only have 2 options: 1) a required (MUST) attribute has an explicit value 2) a require (MUST) attribute has a placeholder valuethe placeholder value is fixed per type, and what it is substituted with uses the same rules as the current code uses to autogenerate values.the command: ipa user-add tuser--homedir=/tmp/tuser--roomnumber=1234 --to-stage would create astaging entry: dn: uid=tuser,cn=staged users,cn=provisioning,$SUFFIX ... roomNumber: 1234 homeDirectory: /tmp/tuser loginShell: shell-plugin-autogenerateloginShell is a MAY attribute, not a MUST attribute, so nothing should be stored at all in the staged entry unless explicitly provided for bythe admin.Then a private DS plugin (catching shell-plugin-autogenerate) generate the loginShell value when the entry becomes active.the command: ipa user-add tuser --homedir=/tmp/tuser--to-stage wouldcreate a staging entry: dn: uid=tuser,cn=staged users,cn=provisioning,$SUFFIX ... roomNumber: -2 homeDirectory: /tmp/tuser loginShell: shell-plugin-autogenerateroomNumber is also a MAY, so what would cause it to be set at -2, andwhy ?the command: ipa user-add tuser --to-stage would create a stagingentry: dn: uid=tuser,cn=staged users,cn=provisioning,$SUFFIX ... roomNumber: -2 homeDirectory: /home/net/shell-tuser loginShell: shell-plugin-autogeneratehomeDirectory should be something like: ?placeholder? IMO, we do notreally want to play templating here.In case the provisioning template does not define 'homeDirectory', then the created entry would take the value from the ipa configdefinition:that value should be taken and applied at the time the user is unstagedand brought in the actual tree, not at the time a user is staged. HTH, Simo.Hello Thierry and Simo, I think Thierry was confused with this part of the design: "This format of placeholders gives enough space for future enhancements. Forexample, Administrator could configure a new template"myhomedirtemplate$/home/net/%{uid}" and use it in the staged LDAP entry. Such value would be replaced by "/home/net/tuser if user uid attribute is setto tuser " My intention when writing this design was to enable future use ofconfigurable placeholders, i.e. a value "?someplaceholder?" could be turn into "/custom/path/%{uid}". But I meant that this can be considered as a future enhancement. For now, I think implementing a placeholder "-1" fornumerical values and "?autogenerate?" for string ones a good start. Martin _______________________________________________ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-develPlease consider the flow: user added staged -> activated/moved to main tree ->deleted/moved to deleted tree -> staged back At the first step his IPA user ID and UID should be undefined and autogenerated.On the last step his IPAUserID and UID should be preserved. The main use case is that this is the user who left the company who comes back again. His files should be still owned by him unless admin forces a flush of his IDs (newswitch???) when he moves user from deleted to staged.Right, the life-cycle feature should work like that naturally, given that onlyattributes with "-1" or "autogenerate" are generated.If admin wants to re-generate the IDs, all he would need to do is to change the attributes back to "-1" after/before moving the user to staging. Question is when it should be done (in deleted tree, in staging tree or after activation)and what API/command we choose.TBH I question the whole idea of "moving to staging", in what case wouldthat make sense ?Admin may want to change not only the UID/GID, but maybe also a home directory (user may be in a different department) so we should make it general. Maybe weshould let user-mod support modification in staging area? Like $ ipa user-mod tuser --uid "-1" --gid "-1" --in-staged or $ ipa user-mod tuser --uid "-1" --gid "-1" --in-deletedThe reason why we have the 'deleted' area is to be able to preserve theuser intact ... I would almost want to ask to explicitly not allowmodifications to deleted users (admin can always use ldapmodify if they*really* need to play some game here).+1, it seemed strange to me that modifying deleted user was allowed as well.Hm, ok, let us not have an API to modify deleted user then.Here's a scenario:- automember is set to add users the appropriate groups when userclass is set to "junior admin", or "senior admin"- Johnny the Junior Admin leaves the company, is deleted - After some time Johnny joins again as Senior AdminI think in this case we'd want to set the userclass to "senior admin" before restoring the user. Other changes (e.g. a name change) can be done after restoring the user, but it still seems cleaner for me if they could be done on the deleted user (or if the deleted user could be restored to stage first). There may be other plugins that run on add and expect current information.
About membership. I think it could be risky to keep membership in 'delete' or 'stage'. Those entries are not valid user and should not belong to any active group. Should we keep membership attributes in those state or let the plugin recompute the valid values when the entry is back to active ?
As for active -> staging users flow, I only think of one scenario: 1) Operator moves staged user to active users 2) Operator realizes that his mouse slipped and he moved a wrong person3) Operator wants to move the person quickly back to staged before anyonenotices :) Martin _______________________________________________ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
_______________________________________________ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel