[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [Freeipa-users] Auto membership plugin



On 03/30/2011 06:32 AM, Rob Crittenden wrote:
Dmitri Pal wrote:
Hello,

Please find the design for the auto membership plugin:
https://fedorahosted.org/freeipa/ticket/753
Here: http://directory.fedoraproject.org/wiki/Auto_Membership_Design

I have some comments and questions:
1) Is the AND functionality for inclusion criteria required?
2) How the attributes are escaped? Do they need to? Probably there will
be cases when they should be escaped
3) Parsing pairs in the value as a bit of overhead. I wonder if there is
any way to avoid it?
4) I have concerns about the UI and CLI, do you see any good ways to
mange such entries?


Because the configuration is stored in cn=config we would need to bind as DM to be able to manage it (unless we want to make an exception and allow writing here. Could a bad config could prevent 389-ds from starting).
No. Similar to a bad DNA or managed entry setup, an error would be logged and the bad config entry would be skipped.

I assume a restart would be needed whenever a configuration change is made?
Only enabling the plug-in at the top level, which we could enabled by default. The definition entry changes would be dynamic.

What happens if the target in automembertargetgroup gets removed?
I still need to fill in the "Behavior" section in the design doc, but this plug-in is not a referential integrity plug-in. It simply monitors ADD operations and updates the membership accordingly. Nothing is done for MOD, DEL, or MODRDN operations.

-NGK

rob


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]