Re: [Freeipa-users] zeroconf/bonjour FreeIPA
On 25.9.2013 08:20, Christian Horn wrote: On Tue, Sep 24, 2013 at 11:23:29AM -0600, Erinn Looney-Triggs wrote: I wanted to bring up the idea of integrating TLSA records into FreeIPA so that a host that is issued a certificate for say the web server (via dogtag) would also publish that information in DNS using a TLSA record. This is very much like how SSHFP records are handled now in FreeIPA. Has this been considered at all? Hm.. another nice idea would be to announce services via zeroconf/bonjour. I guess effectively its the same as having clients search in DNS who offers service XYZ which we already do for ker- beros, ldap etc. Interesting idea. Do you know any real use cases? I have not seen Bonjour in real use except for network printers. Please create RFE ticket (request for enhancement) to prevent it from falling through the cracks: https://fedorahosted.org/freeipa/newticket I would recommend you to add your e-mail address to Cc field in the ticket to get latest updates. We can continue with discussion about use cases here and copy conclusions to the ticket later. -- Petr^2 Spacek ___ Freeipa-users mailing list Freeipa-users@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-users
Re: [Freeipa-users] zeroconf/bonjour FreeIPA
On Wed, Sep 25, 2013 at 08:52:53AM +0200, Petr Spacek wrote: On 25.9.2013 08:20, Christian Horn wrote: Hm.. another nice idea would be to announce services via zeroconf/bonjour. I guess effectively its the same as having clients search in DNS who offers service XYZ which we already do for ker- beros, ldap etc. Interesting idea. Do you know any real use cases? I have not seen Bonjour in real use except for network printers. It can be used for all protocols, so generic service dis- covery. So one could setup a client in a network and see oh, someone offers XMPP service. Here are printers announcing services. This DLNA server offers video streamin. I think the big window managers like gnome3 also started to use those and offer Please create RFE ticket (request for enhancement) to prevent it from falling through the cracks: https://fedorahosted.org/freeipa/newticket Will do, bringing it up there makes definitely sense. But really curious on how widely (or if at all) there is interest in this. I think this style of service discovery is currently more used in desktop environments than in server environments. Christian ___ Freeipa-users mailing list Freeipa-users@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-users
Re: [Freeipa-users] zeroconf/bonjour FreeIPA
On Wed, Sep 25, 2013 at 09:07:17AM +0200, Christian Horn wrote: On Wed, Sep 25, 2013 at 08:52:53AM +0200, Petr Spacek wrote: On 25.9.2013 08:20, Christian Horn wrote: Hm.. another nice idea would be to announce services via zeroconf/bonjour. I guess effectively its the same as having clients search in DNS who offers service XYZ which we already do for ker- beros, ldap etc. Interesting idea. Do you know any real use cases? I have not seen Bonjour in real use except for network printers. It can be used for all protocols, so generic service dis- covery. So one could setup a client in a network and see oh, someone offers XMPP service. Here are printers announcing services. This DLNA server offers video streamin. I think the big window managers like gnome3 also started to use those and offer Traditionally avahi is used as zeroconf implementation on Linux. I think bonjour was Apple's implementation? ___ Freeipa-users mailing list Freeipa-users@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-users
Re: [Freeipa-users] zeroconf/bonjour FreeIPA
On Wed, 25 Sep 2013, Christian Horn wrote: On Wed, Sep 25, 2013 at 08:52:53AM +0200, Petr Spacek wrote: On 25.9.2013 08:20, Christian Horn wrote: Hm.. another nice idea would be to announce services via zeroconf/bonjour. I guess effectively its the same as having clients search in DNS who offers service XYZ which we already do for ker- beros, ldap etc. Interesting idea. Do you know any real use cases? I have not seen Bonjour in real use except for network printers. It can be used for all protocols, so generic service dis- covery. So one could setup a client in a network and see oh, someone offers XMPP service. Here are printers announcing services. This DLNA server offers video streamin. I think the big window managers like gnome3 also started to use those and offer Please create RFE ticket (request for enhancement) to prevent it from falling through the cracks: https://fedorahosted.org/freeipa/newticket Will do, bringing it up there makes definitely sense. But really curious on how widely (or if at all) there is interest in this. I think this style of service discovery is currently more used in desktop environments than in server environments. Before adding a support for this in FreeIPA it is worth to see if any of supposed clients would already have it supported. - OpenLDAP: - no support for zeroconf protocol though a request for adding that was filed in 2006: http://www.openldap.org/its/index.cgi/Contrib?id=4455 and abandoned since 2007. - MIT Kerberos: - no zeroconf support - Heimdal Kereberos: - no zeroconf support For Kerberos zeroconf integration represents some issues since it is generally not guaranteed that IP address of the client would stay the same through the life time of the zeroconf-based network application. Kerberos protocol has some support for NAT-ed clients (a closest scheme where a client IP may fluctuate during session time) so this might not be a big deal, also given that LL networks aren't really in use where Kerberos is in use. However, lack of zeroconf support in libkrb5 makes questionable whole excercise. After all, libkrb5 is able to configure itself, including default realm information, through SRV and TXT records of the default DNS domain supplied to the client. If any other services managed by IPA server (i.e. the ones we can see in 'ipa service-find') need to be exposed to zeroconf-enabled clients, some contextual information is needed in order to publish. A mere existence of the record in IPA database does not mean the service is actually available for use. In zeroconf it is duty of applications that provide the services to publish them to the zeroconf clients. This means when service is available, it is published (via avahi, for example). If service is not running, it is not published. -- / Alexander Bokovoy ___ Freeipa-users mailing list Freeipa-users@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-users
Re: [Freeipa-users] zeroconf/bonjour FreeIPA
On Wed, Sep 25, 2013 at 10:43:16AM +0300, Alexander Bokovoy wrote: Before adding a support for this in FreeIPA it is worth to see if any of supposed clients would already have it supported. I was more having in mind to announce services that IPA learns about automatically, but the server offering the service should do that. - OpenLDAP: - MIT Kerberos: - Heimdal Kereberos: [...] After all, libkrb5 is able to configure itself, including default realm information, through SRV and TXT records of the default DNS domain supplied to the client. ACK, for those I rather see DNS based service discovery to be useful. Christian ___ Freeipa-users mailing list Freeipa-users@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-users
