On Fri, Apr 29, 2016 at 03:38:46PM +0200, Sumit Bose wrote:
> Hi,
>
> please find a new design document at
> https://fedorahosted.org/sssd/wiki/DesignDocs/LookupUsersByCertificatePart2.
> It describes the extended support for user lookup by certificates namely
> for certificates stored in AD and overrides.
>
> The related patches are ready from the functional point of view but I
> want to add some more test before sending them to the list.
>
> For your convenience please find the text of the design document below
> as well.
I'm sorry it took so long to get back to this design page. In general
the design sounds good to me, just see two questions inline:
> === Configuration changes ===
> For the AD provider the currently unset option ''ldap_user_certificate''
> will be set to ''userCertificate;binary''. This means that is a
> certificate is available in the user entry it will be downloaded and
> written to the cache by default. To avoid this ''ldap_user_certificate''
> must be set to a non-existing attribute name like e.g.
> {{{
> ldap_user_certificate = nonExistingAttributeName
> }}}
What would be the use-case for this? To avoid growing the cache?
>
> The ''sss_override user-add'' utility has a new option ''--certificate''
> (''-x'') which expects the base64-endode certificate as an argument.
How would the export work here? Our export command is a CSV file, so I
guess for the first version we could just extend the export to also dump
this additional attribute, but I'm more concerned about someone
forgetting to export the certificate and wiping out their cache. So I
wonder if we should (after the initial implementation) focus on
automatically backing up the exports or even storing the certificates in
the new 'secrets' provider.
_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/sssd-devel@lists.fedorahosted.org
