Design document - Do not always override home directory with subdomain_homedir value in server mode

[Pavel Reichl]

Hello,

please see design page for simple - RFE: Do not always override home 
directory with subdomain_homedir value in server mode.

https://fedorahosted.org/sssd/wiki/DesignDocs/use_AD_homedir

**************************************************************************
**************************************************************************
**************************************************************************

= Do not always override home directory with subdomain_homedir value in 
server mode =

Related ticket(s):
  * https://fedorahosted.org/sssd/ticket/2583

=== Problem statement ===
Prior to sssd 1.12, we didn't have the ability to read home directory 
values from AD in AD-IPA trust setups at all. Instead, we always used 
the `subdomain_homedir` value. We can read custom LDAP values now, but 
in order to stay backwards-compatible, we kept using the 
`subdomain_homedir` value.

=== Use cases ===
Users from AD with POSIX attributes want to use individually set value 
for home directory.

=== Overview of the solution ===
`subdomain_homedir` for SSSD in server mode should support '%o' template 
expansion (The original home directory retrieved from the identity 
provider). In case when `subdomain_homedir` would be expanded to an 
empty string ('subdomain_homedir=%o' and AD user without POSIX 
attributes) SSSD should not error out but `fallback_homedir` should be 
utilized instead.

=== Implementation details ===
* Extend set of attributes returned by `get_object_from_cache()` by 
SYSDB_HOMEDIR attribute.
* Update `apply_subdomain_homedir()`
  * to parse AD home dirrctory from ldb_msg
  * do not call `store_homedir_of_user()` if value of expanded home 
directory is an empty string.
* Extend interface of `get_subdomain_homedir_of_user()` to accept AD 
home directory as parameter.

=== Configuration changes ===
No configuration changes are proposed.

=== How To Test ===
1. On SSSD in server mode
  * For AD user with posix attributes set home directory attribute
   * in sssd.conf set `subdomain_homedir` option to '%o'
   * delete cache and restart SSSD
   * call `getent passwd user` and check that home directory reflects 
value from AD
  * For AD user `without` posix attributes
   * in sssd.conf set `subdomain_homedir` option to %o and 
`fallback_homedir` to /home/%u
   * delete cache and restart SSSD
   * call `getent passwd user` and check that home directory reflects 
`fallback_homedir`
2. On SSSD acting as IPA client
  * Check that results are the same as on SSSD in server mode and that 
local `fallback_homedir` is ignored

=== Authors ===
preichl(a)redhat.com

[Jakub Hrozek]

On Wed, May 27, 2015 at 08:00:44PM +0200, Pavel Reichl wrote:
>  Hello,
>  
>  please see design page for simple - RFE: Do not always override home
>  directory with subdomain_homedir value in server mode.
>  
>  https://fedorahosted.org/sssd/wiki/DesignDocs/use_AD_homedir
>  
>  **************************************************************************
>  **************************************************************************
>  **************************************************************************
>  
>  = Do not always override home directory with subdomain_homedir value in
>  server mode =
>  
>  Related ticket(s):
>   * https://fedorahosted.org/sssd/ticket/2583
>  
>  === Problem statement ===
>  Prior to sssd 1.12, we didn't have the ability to read home directory values
>  from AD in AD-IPA trust setups at all. Instead, we always used the
>  `subdomain_homedir` value. We can read custom LDAP values now, but in order
>  to stay backwards-compatible, we kept using the `subdomain_homedir` value.
>  
>  === Use cases ===
>  Users from AD with POSIX attributes want to use individually set value for
>  home directory.
>  
>  === Overview of the solution ===
>  `subdomain_homedir` for SSSD in server mode should support '%o' template
>  expansion (The original home directory retrieved from the identity
>  provider). In case when `subdomain_homedir` would be expanded to an empty
>  string ('subdomain_homedir=%o' and AD user without POSIX attributes) SSSD
>  should not error out but `fallback_homedir` should be utilized instead. 
Are you proposing to change the default of subdomain_homedir from /home/%d/%u
to /home/%o as well? I think we can do that in a major release if we
properly document the change, but I think then fallback_homedir in IPA
server mode should be changed to /home/%d/%u at the same time.

But I think we should think about two scenarios - new installs and upgrades.
Upgrades shouldn't change, new installs can. Maybe we can file an IPA
ticket to add subdomain_homedir=/home/%d/%u during an upgrade (or do the
change ourselves in an upgrade script) ?

What we would then have is:

    subdomain_homedir   |   POSIX       |   mapping     |
        new install     | server value  | /home/%d/%u   |
        upgrade         | /home/%d/%u   | /home/%d/%u   |

>  
>  === Implementation details ===
>  * Extend set of attributes returned by `get_object_from_cache()` by
>  SYSDB_HOMEDIR attribute.
>  * Update `apply_subdomain_homedir()`
>   * to parse AD home dirrctory from ldb_msg
>   * do not call `store_homedir_of_user()` if value of expanded home directory
>  is an empty string.
>  * Extend interface of `get_subdomain_homedir_of_user()` to accept AD home
>  directory as parameter.
>  
>  === Configuration changes ===
>  No configuration changes are proposed. 
See above

>  
>  === How To Test ===
>  1. On SSSD in server mode
>   * For AD user with posix attributes set home directory attribute
>    * in sssd.conf set `subdomain_homedir` option to '%o'
>    * delete cache and restart SSSD 
We don't need to delete cache, sss_cache is enough here.

>    * call `getent passwd user` and check that home directory reflects
> value
>  from AD
>   * For AD user `without` posix attributes
>    * in sssd.conf set `subdomain_homedir` option to %o and `fallback_homedir`
>  to /home/%u
>    * delete cache and restart SSSD
>    * call `getent passwd user` and check that home directory reflects
>  `fallback_homedir`
>  2. On SSSD acting as IPA client
>   * Check that results are the same as on SSSD in server mode and that local
>  `fallback_homedir` is ignored 
This is a good point, fallback_homedir is ignored on the clients
already, right? Since the clients already just use whatever the extom
plugin sends them and at the moment subdomain_homedir is always sent?

[Pavel Reichl]

On 05/28/2015 10:34 AM, Jakub Hrozek wrote:
>  On Wed, May 27, 2015 at 08:00:44PM +0200, Pavel Reichl wrote:
> > Hello,
> >
> > please see design page for simple - RFE: Do not always override home
> > directory with subdomain_homedir value in server mode.
> >
> > https://fedorahosted.org/sssd/wiki/DesignDocs/use_AD_homedir
> >
> > **************************************************************************
> > **************************************************************************
> > **************************************************************************
> >
> > = Do not always override home directory with subdomain_homedir value in
> > server mode =
> >
> > Related ticket(s):
> >   * https://fedorahosted.org/sssd/ticket/2583
> >
> > === Problem statement ===
> > Prior to sssd 1.12, we didn't have the ability to read home directory values
> > from AD in AD-IPA trust setups at all. Instead, we always used the
> > `subdomain_homedir` value. We can read custom LDAP values now, but in order
> > to stay backwards-compatible, we kept using the `subdomain_homedir` value.
> >
> > === Use cases ===
> > Users from AD with POSIX attributes want to use individually set value for
> > home directory.
> >
> > === Overview of the solution ===
> > `subdomain_homedir` for SSSD in server mode should support '%o' template
> > expansion (The original home directory retrieved from the identity
> > provider). In case when `subdomain_homedir` would be expanded to an empty
> > string ('subdomain_homedir=%o' and AD user without POSIX attributes) SSSD
> > should not error out but `fallback_homedir` should be utilized instead.
>  Are you proposing to change the default of subdomain_homedir from /home/%d/%u
>  to /home/%o as well? I think we can do that in a major release if we
>  properly document the change, but I think then fallback_homedir in IPA
>  server mode should be changed to /home/%d/%u at the same time. 
No I'm not
proposing such change. But I like it and I can add it do 
design page and implement it.  I would do that in a separate patch so we 
can delay release of this change for a major release as you proposed. 
Does this work for you?
>  But I think we should think about two scenarios - new installs and upgrades.
>  Upgrades shouldn't change, new installs can. Maybe we can file an IPA
>  ticket to add subdomain_homedir=/home/%d/%u during an upgrade (or do the
>  change ourselves in an upgrade script) ? 
I see what you mean, mbasti thinks that it
would not be a big problem to 
do on IPA side.
I personally  have no preference here as this is probably my first time 
in this part of SSSD life cycle.
>  What we would then have is:
>
>       subdomain_homedir   |   POSIX       |   mapping     |
>           new install     | server value  | /home/%d/%u   |
>           upgrade         | /home/%d/%u   | /home/%d/%u   |
>
> > === Implementation details ===
> > * Extend set of attributes returned by `get_object_from_cache()` by
> > SYSDB_HOMEDIR attribute.
> > * Update `apply_subdomain_homedir()`
> >   * to parse AD home dirrctory from ldb_msg
> >   * do not call `store_homedir_of_user()` if value of expanded home directory
> > is an empty string.
> > * Extend interface of `get_subdomain_homedir_of_user()` to accept AD home
> > directory as parameter.
> >
> > === Configuration changes ===
> > No configuration changes are proposed.
>  See above
>
> > === How To Test ===
> > 1. On SSSD in server mode
> >   * For AD user with posix attributes set home directory attribute
> >    * in sssd.conf set `subdomain_homedir` option to '%o'
> >    * delete cache and restart SSSD
>  We don't need to delete cache, sss_cache is enough here. 
Sure, I'll amend
it.
> >    * call `getent passwd user` and check that home directory reflects value
> > from AD
> >   * For AD user `without` posix attributes
> >    * in sssd.conf set `subdomain_homedir` option to %o and `fallback_homedir`
> > to /home/%u
> >    * delete cache and restart SSSD
> >    * call `getent passwd user` and check that home directory reflects
> > `fallback_homedir`
> > 2. On SSSD acting as IPA client
> >   * Check that results are the same as on SSSD in server mode and that local
> > `fallback_homedir` is ignored
>  This is a good point, fallback_homedir is ignored on the clients
>  already, right? Since the clients already just use whatever the extom
>  plugin sends them and at the moment subdomain_homedir is always sent? 
Yes,
that's what I see when testing.
>  _______________________________________________
>  sssd-devel mailing list
>  sssd-devel(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

[Jakub Hrozek]

On Thu, May 28, 2015 at 11:23:23AM +0200, Pavel Reichl wrote:
>  
>  
>  On 05/28/2015 10:34 AM, Jakub Hrozek wrote:
>  >On Wed, May 27, 2015 at 08:00:44PM +0200, Pavel Reichl wrote:
>  >>Hello,
>  >>
>  >>please see design page for simple - RFE: Do not always override home
>  >>directory with subdomain_homedir value in server mode.
>  >>
>  >>https://fedorahosted.org/sssd/wiki/DesignDocs/use_AD_homedir
>  >>
>  >>**************************************************************************
>  >>**************************************************************************
>  >>**************************************************************************
>  >>
>  >>= Do not always override home directory with subdomain_homedir value in
>  >>server mode =
>  >>
>  >>Related ticket(s):
>  >>  * https://fedorahosted.org/sssd/ticket/2583
>  >>
>  >>=== Problem statement ===
>  >>Prior to sssd 1.12, we didn't have the ability to read home directory values
>  >>from AD in AD-IPA trust setups at all. Instead, we always used the
>  >>`subdomain_homedir` value. We can read custom LDAP values now, but in order
>  >>to stay backwards-compatible, we kept using the `subdomain_homedir` value.
>  >>
>  >>=== Use cases ===
>  >>Users from AD with POSIX attributes want to use individually set value for
>  >>home directory.
>  >>
>  >>=== Overview of the solution ===
>  >>`subdomain_homedir` for SSSD in server mode should support '%o' template
>  >>expansion (The original home directory retrieved from the identity
>  >>provider). In case when `subdomain_homedir` would be expanded to an empty
>  >>string ('subdomain_homedir=%o' and AD user without POSIX attributes)
> SSSD
>  >>should not error out but `fallback_homedir` should be utilized instead.
>  >Are you proposing to change the default of subdomain_homedir from /home/%d/%u
>  >to /home/%o as well? I think we can do that in a major release if we
>  >properly document the change, but I think then fallback_homedir in IPA
>  >server mode should be changed to /home/%d/%u at the same time.
>  No I'm not proposing such change. But I like it and I can add it do design
>  page and implement it. 
Let's discuss it on the meeting today (and then circle back to the list
so everything is recorded)

>  I would do that in a separate patch so we can delay
>  release of this change for a major release as you proposed. Does this work
>  for you? 
By major release I mean 1.13 :-) But yes, this should be a separate
change.

[Sumit Bose]

On Thu, May 28, 2015 at 11:30:34AM +0200, Jakub Hrozek wrote:
>  On Thu, May 28, 2015 at 11:23:23AM +0200, Pavel Reichl wrote:
>  > 
>  > 
>  > On 05/28/2015 10:34 AM, Jakub Hrozek wrote:
>  > >On Wed, May 27, 2015 at 08:00:44PM +0200, Pavel Reichl wrote:
>  > >>Hello,
>  > >>
>  > >>please see design page for simple - RFE: Do not always override home
>  > >>directory with subdomain_homedir value in server mode.
>  > >>
>  > >>https://fedorahosted.org/sssd/wiki/DesignDocs/use_AD_homedir
>  > >>
>  > >>**************************************************************************
>  > >>**************************************************************************
>  > >>**************************************************************************
>  > >>
>  > >>= Do not always override home directory with subdomain_homedir value in
>  > >>server mode =
>  > >>
>  > >>Related ticket(s):
>  > >>  * https://fedorahosted.org/sssd/ticket/2583
>  > >>
>  > >>=== Problem statement ===
>  > >>Prior to sssd 1.12, we didn't have the ability to read home directory
> values
>  > >>from AD in AD-IPA trust setups at all. Instead, we always used the
>  > >>`subdomain_homedir` value. We can read custom LDAP values now, but in order
>  > >>to stay backwards-compatible, we kept using the `subdomain_homedir` value.
>  > >>
>  > >>=== Use cases ===
>  > >>Users from AD with POSIX attributes want to use individually set value for
>  > >>home directory.
>  > >>
>  > >>=== Overview of the solution ===
>  > >>`subdomain_homedir` for SSSD in server mode should support '%o'
> template
>  > >>expansion (The original home directory retrieved from the identity
>  > >>provider). In case when `subdomain_homedir` would be expanded to an empty
>  > >>string ('subdomain_homedir=%o' and AD user without POSIX attributes)
> SSSD
>  > >>should not error out but `fallback_homedir` should be utilized instead.
>  > >Are you proposing to change the default of subdomain_homedir from /home/%d/%u
>  > >to /home/%o as well? I think we can do that in a major release if we
>  > >properly document the change, but I think then fallback_homedir in IPA
>  > >server mode should be changed to /home/%d/%u at the same time.
>  > No I'm not proposing such change. But I like it and I can add it do design
>  > page and implement it.
>  
>  Let's discuss it on the meeting today (and then circle back to the list
>  so everything is recorded) 
As long as this only relates to SSSD in ipa-server-mode we can use the
type of the idranges to switch the default of subdomain_homedir?

bye,
Sumit

>  
>  > I would do that in a separate patch so we can delay
>  > release of this change for a major release as you proposed. Does this work
>  > for you?
>  
>  By major release I mean 1.13 :-) But yes, this should be a separate
>  change.
>  _______________________________________________
>  sssd-devel mailing list
>  sssd-devel(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

[Jakub Hrozek]

On Thu, May 28, 2015 at 11:50:15AM +0200, Sumit Bose wrote:
>  On Thu, May 28, 2015 at 11:30:34AM +0200, Jakub Hrozek wrote:
>  > On Thu, May 28, 2015 at 11:23:23AM +0200, Pavel Reichl wrote:
>  > > 
>  > > 
>  > > On 05/28/2015 10:34 AM, Jakub Hrozek wrote:
>  > > >On Wed, May 27, 2015 at 08:00:44PM +0200, Pavel Reichl wrote:
>  > > >>Hello,
>  > > >>
>  > > >>please see design page for simple - RFE: Do not always override home
>  > > >>directory with subdomain_homedir value in server mode.
>  > > >>
>  > > >>https://fedorahosted.org/sssd/wiki/DesignDocs/use_AD_homedir
>  > > >>
>  > >
> >>**************************************************************************
>  > >
> >>**************************************************************************
>  > >
> >>**************************************************************************
>  > > >>
>  > > >>= Do not always override home directory with subdomain_homedir value
> in
>  > > >>server mode =
>  > > >>
>  > > >>Related ticket(s):
>  > > >>  * https://fedorahosted.org/sssd/ticket/2583
>  > > >>
>  > > >>=== Problem statement ===
>  > > >>Prior to sssd 1.12, we didn't have the ability to read home
> directory values
>  > > >>from AD in AD-IPA trust setups at all. Instead, we always used the
>  > > >>`subdomain_homedir` value. We can read custom LDAP values now, but in
> order
>  > > >>to stay backwards-compatible, we kept using the `subdomain_homedir`
> value.
>  > > >>
>  > > >>=== Use cases ===
>  > > >>Users from AD with POSIX attributes want to use individually set value
> for
>  > > >>home directory.
>  > > >>
>  > > >>=== Overview of the solution ===
>  > > >>`subdomain_homedir` for SSSD in server mode should support '%o'
> template
>  > > >>expansion (The original home directory retrieved from the identity
>  > > >>provider). In case when `subdomain_homedir` would be expanded to an
> empty
>  > > >>string ('subdomain_homedir=%o' and AD user without POSIX
> attributes) SSSD
>  > > >>should not error out but `fallback_homedir` should be utilized
> instead.
>  > > >Are you proposing to change the default of subdomain_homedir from
> /home/%d/%u
>  > > >to /home/%o as well? I think we can do that in a major release if we
>  > > >properly document the change, but I think then fallback_homedir in IPA
>  > > >server mode should be changed to /home/%d/%u at the same time.
>  > > No I'm not proposing such change. But I like it and I can add it do design
>  > > page and implement it.
>  > 
>  > Let's discuss it on the meeting today (and then circle back to the list
>  > so everything is recorded)
>  
>  As long as this only relates to SSSD in ipa-server-mode we can use the
>  type of the idranges to switch the default of subdomain_homedir? 
Good idea.

Do you also agree that on upgrades, we should add:
    subdomain_homedir = /home/%d/%u

To be backwards-compatible? Users can then just uncomment the value to
get POSIX attributes from LDAP..

[Sumit Bose]

On Thu, May 28, 2015 at 12:04:31PM +0200, Jakub Hrozek wrote:
>  On Thu, May 28, 2015 at 11:50:15AM +0200, Sumit Bose wrote:
>  > On Thu, May 28, 2015 at 11:30:34AM +0200, Jakub Hrozek wrote:
>  > > On Thu, May 28, 2015 at 11:23:23AM +0200, Pavel Reichl wrote:
>  > > > 
>  > > > 
>  > > > On 05/28/2015 10:34 AM, Jakub Hrozek wrote:
>  > > > >On Wed, May 27, 2015 at 08:00:44PM +0200, Pavel Reichl wrote:
>  > > > >>Hello,
>  > > > >>
>  > > > >>please see design page for simple - RFE: Do not always override
> home
>  > > > >>directory with subdomain_homedir value in server mode.
>  > > > >>
>  > > > >>https://fedorahosted.org/sssd/wiki/DesignDocs/use_AD_homedir
>  > > > >>
>  > > >
> >>**************************************************************************
>  > > >
> >>**************************************************************************
>  > > >
> >>**************************************************************************
>  > > > >>
>  > > > >>= Do not always override home directory with subdomain_homedir
> value in
>  > > > >>server mode =
>  > > > >>
>  > > > >>Related ticket(s):
>  > > > >>  * https://fedorahosted.org/sssd/ticket/2583
>  > > > >>
>  > > > >>=== Problem statement ===
>  > > > >>Prior to sssd 1.12, we didn't have the ability to read home
> directory values
>  > > > >>from AD in AD-IPA trust setups at all. Instead, we always used
> the
>  > > > >>`subdomain_homedir` value. We can read custom LDAP values now, but
> in order
>  > > > >>to stay backwards-compatible, we kept using the
> `subdomain_homedir` value.
>  > > > >>
>  > > > >>=== Use cases ===
>  > > > >>Users from AD with POSIX attributes want to use individually set
> value for
>  > > > >>home directory.
>  > > > >>
>  > > > >>=== Overview of the solution ===
>  > > > >>`subdomain_homedir` for SSSD in server mode should support
> '%o' template
>  > > > >>expansion (The original home directory retrieved from the
> identity
>  > > > >>provider). In case when `subdomain_homedir` would be expanded to
> an empty
>  > > > >>string ('subdomain_homedir=%o' and AD user without POSIX
> attributes) SSSD
>  > > > >>should not error out but `fallback_homedir` should be utilized
> instead.
>  > > > >Are you proposing to change the default of subdomain_homedir from
> /home/%d/%u
>  > > > >to /home/%o as well? I think we can do that in a major release if we
>  > > > >properly document the change, but I think then fallback_homedir in
> IPA
>  > > > >server mode should be changed to /home/%d/%u at the same time.
>  > > > No I'm not proposing such change. But I like it and I can add it do
> design
>  > > > page and implement it.
>  > > 
>  > > Let's discuss it on the meeting today (and then circle back to the list
>  > > so everything is recorded)
>  > 
>  > As long as this only relates to SSSD in ipa-server-mode we can use the
>  > type of the idranges to switch the default of subdomain_homedir?
>  
>  Good idea.
>  
>  Do you also agree that on upgrades, we should add:
>      subdomain_homedir = /home/%d/%u 
as along as we change the defaults we have to do something like this
during rpm upgrade. Maybe we should carry the discussion about sensible
defaults for a new major SSSD release to freeipa-users as well?

bye,
Sumit

>  
>  To be backwards-compatible? Users can then just uncomment the value to
>  get POSIX attributes from LDAP..
>  _______________________________________________
>  sssd-devel mailing list
>  sssd-devel(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

[Jakub Hrozek]

On Thu, May 28, 2015 at 12:37:34PM +0200, Sumit Bose wrote:
>  On Thu, May 28, 2015 at 12:04:31PM +0200, Jakub Hrozek wrote:
>  > On Thu, May 28, 2015 at 11:50:15AM +0200, Sumit Bose wrote:
>  > > On Thu, May 28, 2015 at 11:30:34AM +0200, Jakub Hrozek wrote:
>  > > > On Thu, May 28, 2015 at 11:23:23AM +0200, Pavel Reichl wrote:
>  > > > > 
>  > > > > 
>  > > > > On 05/28/2015 10:34 AM, Jakub Hrozek wrote:
>  > > > > >On Wed, May 27, 2015 at 08:00:44PM +0200, Pavel Reichl wrote:
>  > > > > >>Hello,
>  > > > > >>
>  > > > > >>please see design page for simple - RFE: Do not always
> override home
>  > > > > >>directory with subdomain_homedir value in server mode.
>  > > > > >>
>  > > > > >>https://fedorahosted.org/sssd/wiki/DesignDocs/use_AD_homedir
>  > > > > >>
>  > > > >
> >>**************************************************************************
>  > > > >
> >>**************************************************************************
>  > > > >
> >>**************************************************************************
>  > > > > >>
>  > > > > >>= Do not always override home directory with
> subdomain_homedir value in
>  > > > > >>server mode =
>  > > > > >>
>  > > > > >>Related ticket(s):
>  > > > > >>  * https://fedorahosted.org/sssd/ticket/2583
>  > > > > >>
>  > > > > >>=== Problem statement ===
>  > > > > >>Prior to sssd 1.12, we didn't have the ability to read
> home directory values
>  > > > > >>from AD in AD-IPA trust setups at all. Instead, we always
> used the
>  > > > > >>`subdomain_homedir` value. We can read custom LDAP values
> now, but in order
>  > > > > >>to stay backwards-compatible, we kept using the
> `subdomain_homedir` value.
>  > > > > >>
>  > > > > >>=== Use cases ===
>  > > > > >>Users from AD with POSIX attributes want to use individually
> set value for
>  > > > > >>home directory.
>  > > > > >>
>  > > > > >>=== Overview of the solution ===
>  > > > > >>`subdomain_homedir` for SSSD in server mode should support
> '%o' template
>  > > > > >>expansion (The original home directory retrieved from the
> identity
>  > > > > >>provider). In case when `subdomain_homedir` would be expanded
> to an empty
>  > > > > >>string ('subdomain_homedir=%o' and AD user without
> POSIX attributes) SSSD
>  > > > > >>should not error out but `fallback_homedir` should be
> utilized instead.
>  > > > > >Are you proposing to change the default of subdomain_homedir from
> /home/%d/%u
>  > > > > >to /home/%o as well? I think we can do that in a major release if
> we
>  > > > > >properly document the change, but I think then fallback_homedir
> in IPA
>  > > > > >server mode should be changed to /home/%d/%u at the same time.
>  > > > > No I'm not proposing such change. But I like it and I can add it
> do design
>  > > > > page and implement it.
>  > > > 
>  > > > Let's discuss it on the meeting today (and then circle back to the
> list
>  > > > so everything is recorded)
>  > > 
>  > > As long as this only relates to SSSD in ipa-server-mode we can use the
>  > > type of the idranges to switch the default of subdomain_homedir?
>  > 
>  > Good idea.
>  > 
>  > Do you also agree that on upgrades, we should add:
>  >     subdomain_homedir = /home/%d/%u
>  
>  as along as we change the defaults we have to do something like this
>  during rpm upgrade. Maybe we should carry the discussion about sensible
>  defaults for a new major SSSD release to freeipa-users as well? 
Yes, Pavel, can you start the thread since you own the ticket?

[Pavel Reichl]

On 05/28/2015 01:24 PM, Jakub Hrozek wrote:
>  On Thu, May 28, 2015 at 12:37:34PM +0200, Sumit Bose wrote:
> > On Thu, May 28, 2015 at 12:04:31PM +0200, Jakub Hrozek wrote:
> >> On Thu, May 28, 2015 at 11:50:15AM +0200, Sumit Bose wrote:
> >>> On Thu, May 28, 2015 at 11:30:34AM +0200, Jakub Hrozek wrote:
> >>>> On Thu, May 28, 2015 at 11:23:23AM +0200, Pavel Reichl wrote:
> >>>>>
> >>>>> On 05/28/2015 10:34 AM, Jakub Hrozek wrote:
> >>>>>> On Wed, May 27, 2015 at 08:00:44PM +0200, Pavel Reichl wrote:
> >>>>>>> Hello,
> >>>>>>>
> >>>>>>> please see design page for simple - RFE: Do not always
> override home
> >>>>>>> directory with subdomain_homedir value in server mode.
> >>>>>>>
> >>>>>>> https://fedorahosted.org/sssd/wiki/DesignDocs/use_AD_homedir
> >>>>>>>
> >>>>>>>
> **************************************************************************
> >>>>>>>
> **************************************************************************
> >>>>>>>
> **************************************************************************
> >>>>>>>
> >>>>>>> = Do not always override home directory with
> subdomain_homedir value in
> >>>>>>> server mode =
> >>>>>>>
> >>>>>>> Related ticket(s):
> >>>>>>>   * https://fedorahosted.org/sssd/ticket/2583
> >>>>>>>
> >>>>>>> === Problem statement ===
> >>>>>>> Prior to sssd 1.12, we didn't have the ability to read
> home directory values
> >>>>>> >from AD in AD-IPA trust setups at all. Instead, we always
> used the
> >>>>>>> `subdomain_homedir` value. We can read custom LDAP values
> now, but in order
> >>>>>>> to stay backwards-compatible, we kept using the
> `subdomain_homedir` value.
> >>>>>>>
> >>>>>>> === Use cases ===
> >>>>>>> Users from AD with POSIX attributes want to use individually
> set value for
> >>>>>>> home directory.
> >>>>>>>
> >>>>>>> === Overview of the solution ===
> >>>>>>> `subdomain_homedir` for SSSD in server mode should support
> '%o' template
> >>>>>>> expansion (The original home directory retrieved from the
> identity
> >>>>>>> provider). In case when `subdomain_homedir` would be expanded
> to an empty
> >>>>>>> string ('subdomain_homedir=%o' and AD user without
> POSIX attributes) SSSD
> >>>>>>> should not error out but `fallback_homedir` should be
> utilized instead.
> >>>>>> Are you proposing to change the default of subdomain_homedir from
> /home/%d/%u
> >>>>>> to /home/%o as well? I think we can do that in a major release if
> we
> >>>>>> properly document the change, but I think then fallback_homedir
> in IPA
> >>>>>> server mode should be changed to /home/%d/%u at the same time.
> >>>>> No I'm not proposing such change. But I like it and I can add it
> do design
> >>>>> page and implement it.
> >>>> Let's discuss it on the meeting today (and then circle back to the
> list
> >>>> so everything is recorded)
> >>> As long as this only relates to SSSD in ipa-server-mode we can use the
> >>> type of the idranges to switch the default of subdomain_homedir?
> >> Good idea.
> >>
> >> Do you also agree that on upgrades, we should add:
> >>      subdomain_homedir = /home/%d/%u
> > as along as we change the defaults we have to do something like this
> > during rpm upgrade. Maybe we should carry the discussion about sensible
> > defaults for a new major SSSD release to freeipa-users as well?
>  Yes, Pavel, can you start the thread since you own the ticket? 
Thread with subject
'Sensible defaults for a new major SSSD release' has 
been started on  freeipa-users.
>  _______________________________________________
>  sssd-devel mailing list
>  sssd-devel(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

[Pavel Reichl]

On 05/28/2015 11:50 AM, Sumit Bose wrote:
>  On Thu, May 28, 2015 at 11:30:34AM +0200, Jakub Hrozek wrote:
> > On Thu, May 28, 2015 at 11:23:23AM +0200, Pavel Reichl wrote:
> >>
> >> On 05/28/2015 10:34 AM, Jakub Hrozek wrote:
> >>> On Wed, May 27, 2015 at 08:00:44PM +0200, Pavel Reichl wrote:
> >>>> Hello,
> >>>>
> >>>> please see design page for simple - RFE: Do not always override home
> >>>> directory with subdomain_homedir value in server mode.
> >>>>
> >>>> https://fedorahosted.org/sssd/wiki/DesignDocs/use_AD_homedir
> >>>>
> >>>>
> **************************************************************************
> >>>>
> **************************************************************************
> >>>>
> **************************************************************************
> >>>>
> >>>> = Do not always override home directory with subdomain_homedir value in
> >>>> server mode =
> >>>>
> >>>> Related ticket(s):
> >>>>   * https://fedorahosted.org/sssd/ticket/2583
> >>>>
> >>>> === Problem statement ===
> >>>> Prior to sssd 1.12, we didn't have the ability to read home directory
> values
> >>> >from AD in AD-IPA trust setups at all. Instead, we always used the
> >>>> `subdomain_homedir` value. We can read custom LDAP values now, but in
> order
> >>>> to stay backwards-compatible, we kept using the `subdomain_homedir`
> value.
> >>>>
> >>>> === Use cases ===
> >>>> Users from AD with POSIX attributes want to use individually set value
> for
> >>>> home directory.
> >>>>
> >>>> === Overview of the solution ===
> >>>> `subdomain_homedir` for SSSD in server mode should support '%o'
> template
> >>>> expansion (The original home directory retrieved from the identity
> >>>> provider). In case when `subdomain_homedir` would be expanded to an
> empty
> >>>> string ('subdomain_homedir=%o' and AD user without POSIX
> attributes) SSSD
> >>>> should not error out but `fallback_homedir` should be utilized instead.
> >>> Are you proposing to change the default of subdomain_homedir from
> /home/%d/%u
> >>> to /home/%o as well? I think we can do that in a major release if we
> >>> properly document the change, but I think then fallback_homedir in IPA
> >>> server mode should be changed to /home/%d/%u at the same time.
> >> No I'm not proposing such change. But I like it and I can add it do design
> >> page and implement it.
> > Let's discuss it on the meeting today (and then circle back to the list
> > so everything is recorded)
>  As long as this only relates to SSSD in ipa-server-mode we can use the
>  type of the idranges to switch the default of subdomain_homedir? 
I am sorry I
don't follow. Could you please elaborate on how we can 
switch the default of subdomain_homedir based on type of the id ranges? 
Thanks!
>  bye,
>  Sumit
>
> >> I would do that in a separate patch so we can delay
> >> release of this change for a major release as you proposed. Does this work
> >> for you?
> > By major release I mean 1.13 :-) But yes, this should be a separate
> > change.
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel(a)lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>  _______________________________________________
>  sssd-devel mailing list
>  sssd-devel(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

[Sumit Bose]

On Thu, May 28, 2015 at 01:31:27PM +0200, Pavel Reichl wrote:
>  
>  
>  On 05/28/2015 11:50 AM, Sumit Bose wrote:
>  >On Thu, May 28, 2015 at 11:30:34AM +0200, Jakub Hrozek wrote:
>  >>On Thu, May 28, 2015 at 11:23:23AM +0200, Pavel Reichl wrote:
>  >>>
>  >>>On 05/28/2015 10:34 AM, Jakub Hrozek wrote:
>  >>>>On Wed, May 27, 2015 at 08:00:44PM +0200, Pavel Reichl wrote:
>  >>>>>Hello,
>  >>>>>
>  >>>>>please see design page for simple - RFE: Do not always override home
>  >>>>>directory with subdomain_homedir value in server mode.
>  >>>>>
>  >>>>>https://fedorahosted.org/sssd/wiki/DesignDocs/use_AD_homedir
>  >>>>>
>
> >>>>>**************************************************************************
>
> >>>>>**************************************************************************
>
> >>>>>**************************************************************************
>  >>>>>
>  >>>>>= Do not always override home directory with subdomain_homedir value
> in
>  >>>>>server mode =
>  >>>>>
>  >>>>>Related ticket(s):
>  >>>>>  * https://fedorahosted.org/sssd/ticket/2583
>  >>>>>
>  >>>>>=== Problem statement ===
>  >>>>>Prior to sssd 1.12, we didn't have the ability to read home
> directory values
>  >>>>>from AD in AD-IPA trust setups at all. Instead, we always used the
>  >>>>>`subdomain_homedir` value. We can read custom LDAP values now, but in
> order
>  >>>>>to stay backwards-compatible, we kept using the `subdomain_homedir`
> value.
>  >>>>>
>  >>>>>=== Use cases ===
>  >>>>>Users from AD with POSIX attributes want to use individually set
> value for
>  >>>>>home directory.
>  >>>>>
>  >>>>>=== Overview of the solution ===
>  >>>>>`subdomain_homedir` for SSSD in server mode should support
> '%o' template
>  >>>>>expansion (The original home directory retrieved from the identity
>  >>>>>provider). In case when `subdomain_homedir` would be expanded to an
> empty
>  >>>>>string ('subdomain_homedir=%o' and AD user without POSIX
> attributes) SSSD
>  >>>>>should not error out but `fallback_homedir` should be utilized
> instead.
>  >>>>Are you proposing to change the default of subdomain_homedir from
> /home/%d/%u
>  >>>>to /home/%o as well? I think we can do that in a major release if we
>  >>>>properly document the change, but I think then fallback_homedir in IPA
>  >>>>server mode should be changed to /home/%d/%u at the same time.
>  >>>No I'm not proposing such change. But I like it and I can add it do
> design
>  >>>page and implement it.
>  >>Let's discuss it on the meeting today (and then circle back to the list
>  >>so everything is recorded)
>  >As long as this only relates to SSSD in ipa-server-mode we can use the
>  >type of the idranges to switch the default of subdomain_homedir?
>  I am sorry I don't follow. Could you please elaborate on how we can switch
>  the default of subdomain_homedir based on type of the id ranges? Thanks! 
Trusted AD domains basically can have either 'ipa-ad-trust-posix' or
'ipa-ad-trust' idrange types where the IDs are read from AD or are
autogenerated respectively. If the range type is 'ipa-ad-trust-posix'
we can assume the '%o' for subdomain_homedir and if it is 'ipa-ad-trust'
we can use '/home/%d/%u'.

With this we do not have to set subdomain_homedir or fallback_homedir in
sssd.conf for new installations.

bye,
Sumit

>  >
>  >bye,
>  >Sumit
>  >
>  >>>I would do that in a separate patch so we can delay
>  >>>release of this change for a major release as you proposed. Does this work
>  >>>for you?
>  >>By major release I mean 1.13 :-) But yes, this should be a separate
>  >>change.
>  >>_______________________________________________
>  >>sssd-devel mailing list
>  >>sssd-devel(a)lists.fedorahosted.org
>  >>https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>  >_______________________________________________
>  >sssd-devel mailing list
>  >sssd-devel(a)lists.fedorahosted.org
>  >https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>  
>  _______________________________________________
>  sssd-devel mailing list
>  sssd-devel(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

[Pavel Reichl]

On 05/28/2015 01:49 PM, Sumit Bose wrote:
>  On Thu, May 28, 2015 at 01:31:27PM +0200, Pavel Reichl wrote:
> >
> > On 05/28/2015 11:50 AM, Sumit Bose wrote:
> >> On Thu, May 28, 2015 at 11:30:34AM +0200, Jakub Hrozek wrote:
> >>> On Thu, May 28, 2015 at 11:23:23AM +0200, Pavel Reichl wrote:
> >>>> On 05/28/2015 10:34 AM, Jakub Hrozek wrote:
> >>>>> On Wed, May 27, 2015 at 08:00:44PM +0200, Pavel Reichl wrote:
> >>>>>> Hello,
> >>>>>>
> >>>>>> please see design page for simple - RFE: Do not always override
> home
> >>>>>> directory with subdomain_homedir value in server mode.
> >>>>>>
> >>>>>> https://fedorahosted.org/sssd/wiki/DesignDocs/use_AD_homedir
> >>>>>>
> >>>>>>
> **************************************************************************
> >>>>>>
> **************************************************************************
> >>>>>>
> **************************************************************************
> >>>>>>
> >>>>>> = Do not always override home directory with subdomain_homedir
> value in
> >>>>>> server mode =
> >>>>>>
> >>>>>> Related ticket(s):
> >>>>>>   * https://fedorahosted.org/sssd/ticket/2583
> >>>>>>
> >>>>>> === Problem statement ===
> >>>>>> Prior to sssd 1.12, we didn't have the ability to read home
> directory values
> >>>>> >from AD in AD-IPA trust setups at all. Instead, we always used
> the
> >>>>>> `subdomain_homedir` value. We can read custom LDAP values now,
> but in order
> >>>>>> to stay backwards-compatible, we kept using the
> `subdomain_homedir` value.
> >>>>>>
> >>>>>> === Use cases ===
> >>>>>> Users from AD with POSIX attributes want to use individually set
> value for
> >>>>>> home directory.
> >>>>>>
> >>>>>> === Overview of the solution ===
> >>>>>> `subdomain_homedir` for SSSD in server mode should support
> '%o' template
> >>>>>> expansion (The original home directory retrieved from the
> identity
> >>>>>> provider). In case when `subdomain_homedir` would be expanded to
> an empty
> >>>>>> string ('subdomain_homedir=%o' and AD user without POSIX
> attributes) SSSD
> >>>>>> should not error out but `fallback_homedir` should be utilized
> instead.
> >>>>> Are you proposing to change the default of subdomain_homedir from
> /home/%d/%u
> >>>>> to /home/%o as well? I think we can do that in a major release if we
> >>>>> properly document the change, but I think then fallback_homedir in
> IPA
> >>>>> server mode should be changed to /home/%d/%u at the same time.
> >>>> No I'm not proposing such change. But I like it and I can add it do
> design
> >>>> page and implement it.
> >>> Let's discuss it on the meeting today (and then circle back to the list
> >>> so everything is recorded)
> >> As long as this only relates to SSSD in ipa-server-mode we can use the
> >> type of the idranges to switch the default of subdomain_homedir?
> > I am sorry I don't follow. Could you please elaborate on how we can switch
> > the default of subdomain_homedir based on type of the id ranges? Thanks!
>  Trusted AD domains basically can have either 'ipa-ad-trust-posix' or
>  'ipa-ad-trust' idrange types where the IDs are read from AD or are
>  autogenerated respectively. If the range type is 'ipa-ad-trust-posix'
>  we can assume the '%o' for subdomain_homedir and if it is 'ipa-ad-trust'
>  we can use '/home/%d/%u'.
>
>  With this we do not have to set subdomain_homedir or fallback_homedir in
>  sssd.conf for new installations. 
Oh, I see now, thanks for explaining.
>  bye,
>  Sumit
>
> >> bye,
> >> Sumit
> >>
> >>>> I would do that in a separate patch so we can delay
> >>>> release of this change for a major release as you proposed. Does this
> work
> >>>> for you?
> >>> By major release I mean 1.13 :-) But yes, this should be a separate
> >>> change.
> >>> _______________________________________________
> >>> sssd-devel mailing list
> >>> sssd-devel(a)lists.fedorahosted.org
> >>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >> _______________________________________________
> >> sssd-devel mailing list
> >> sssd-devel(a)lists.fedorahosted.org
> >> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel(a)lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>  _______________________________________________
>  sssd-devel mailing list
>  sssd-devel(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/sssd-devel