URL: https://github.com/SSSD/sssd/pull/255 Author: lslebodn Title: #255: Use default configuration with missing sssd.conf Action: opened
PR body: """ https://pagure.io/SSSD/sssd/issue/3339 """
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/255/head:pr255 git checkout pr255
URL: https://github.com/SSSD/sssd/pull/255 Title: #255: Use default configuration with missing sssd.conf
lslebodn commented: """ http://sssd-ci.duckdns.org/logs/job/68/92/summary.html """
See the full comment at https://github.com/SSSD/sssd/pull/255#issuecomment-298604817
URL: https://github.com/SSSD/sssd/pull/255 Title: #255: Use default configuration with missing sssd.conf
jhrozek commented: """ This is a change in behaviour. I explicitly wanted to enable the functionality with missing sssd.conf to be at least opt-out. I'm not sure if e.g. RHEL-7 would be OK with this.
I'm fine with changing the default of `--enable-files-domain` from disabled to enabled so that missing sssd.conf starts sssd with the files domain in RHEL-8 and Fedora, but I also think that there should be a way for conservative distributions to opt out of this and keep failing with missing sssd.conf """
See the full comment at https://github.com/SSSD/sssd/pull/255#issuecomment-299134531
URL: https://github.com/SSSD/sssd/pull/255 Title: #255: Use default configuration with missing sssd.conf
lslebodn commented: """ We already enabled starting sssd with missing sssd.conf in 1.14.0. The problem was not with missing sssd.conf but there were other reasons why it was reverted in rhel. Unnecessary, "domain/shadowutils" in sssd.conf and AVC denials when copying to /etc/sssd/
Current approach is different and will not cause such problems. """
See the full comment at https://github.com/SSSD/sssd/pull/255#issuecomment-299443473
URL: https://github.com/SSSD/sssd/pull/255 Title: #255: Use default configuration with missing sssd.conf
lslebodn commented: """ For reference https://bugzilla.redhat.com/show_bug.cgi?id=1369118 """
See the full comment at https://github.com/SSSD/sssd/pull/255#issuecomment-299443621
URL: https://github.com/SSSD/sssd/pull/255 Title: #255: Use default configuration with missing sssd.conf
lslebodn commented: """ BTW We needn't enable `enable_files_domain` by default. It was just required in case of missing sssd.conf. Therefore it was added into `SSSD_FALLBACK_CONFIG_LDIF` """
See the full comment at https://github.com/SSSD/sssd/pull/255#issuecomment-299444386
URL: https://github.com/SSSD/sssd/pull/255 Title: #255: Use default configuration with missing sssd.conf
jhrozek commented: """ The problem I was considering was that before (in current master), if you compile sssd with `--disable-files-domain` (which is the default), then you can't start sssd without a config file. This patch changes this behaviour to start the implicit domain with no config file, so what the option now does is adding the additional files domain even if explicit domains are configured, right?
I'm not sure I would like that in RHEL. Although typically in RHEL, the order of nsswitch modules is "files sss", so for files users, sss wouldn't be typically reached at all..which might make the change OK.. """
See the full comment at https://github.com/SSSD/sssd/pull/255#issuecomment-299450895
URL: https://github.com/SSSD/sssd/pull/255 Title: #255: Use default configuration with missing sssd.conf
lslebodn commented: """
The problem I was considering was that before (in current master), if you compile sssd with --disable-files-domain (which is the default), then you can't start sssd without a config file.
And it is a bug because this options has nothing to do with missing configuration file. ``` --enable-files-domain If this feature is enabled, then SSSD always enables a domain with id_provider=files even if the domain is not specified in the config file [default=no] ``` it just changes default value of the option `enable_files_domain` from `false` to `true` ``` enable_files_domain (boolean) When this option is enabled, SSSD prepends an implicit domain with “id_provider=files” before any explicitly configured domains.
Default: false ```
This patch changes this behaviour to start the implicit domain with no config file, so what the option now does is adding the additional files domain even if explicit domains are configured, right?
`prepends an implicit domain` has nothing to do missing `sssd.conf` from semantical POV. They are two different things. It is just an implementation detail that `enable_files_domain = true`. The same could be achieved with different `SSSD_FALLBACK_CONFIG_LDIF` but `SSSD_FALLBACK_CONFIG_LDIF` would be much bigger.
I'm not sure I would like that in RHEL. Although typically in RHEL, the order of nsswitch modules is "files sss", so for files users, sss wouldn't be typically reached at all..which might make the change OK..
There is not a huge functional difference between this PR and version which was introduced a year ago 59744cff6edb106ae799b2321cb8731edadf409a. And As I already mention 59744cff6edb106ae799b2321cb8731edadf409a was reverted in RHEL due to other reasons and not because missing sssd.conf caused problems """
See the full comment at https://github.com/SSSD/sssd/pull/255#issuecomment-299459227
URL: https://github.com/SSSD/sssd/pull/255 Title: #255: Use default configuration with missing sssd.conf
pbrezina commented: """ Description of this option really doesn't say anything about missing configuration file, but users interpretation may be vague. However, I believe we can go with this, since if configuration file is missing but sssd is still run on start up (but is not supposed to) it should be just disabled on systemd level... """
See the full comment at https://github.com/SSSD/sssd/pull/255#issuecomment-300455385
URL: https://github.com/SSSD/sssd/pull/255 Title: #255: Use default configuration with missing sssd.conf
lslebodn commented: """
sssd is still run on start up (but is not supposed to) it should be just disabled on systemd level...
@jhrozek I hope you agree with Pavel :-) """
See the full comment at https://github.com/SSSD/sssd/pull/255#issuecomment-302733882
URL: https://github.com/SSSD/sssd/pull/255 Title: #255: Use default configuration with missing sssd.conf
lslebodn commented: """
sssd is still run on start up (but is not supposed to) it should be just disabled on systemd level...
@jhrozek I hope you agree with Pavel :-) """
See the full comment at https://github.com/SSSD/sssd/pull/255#issuecomment-302733882
URL: https://github.com/SSSD/sssd/pull/255 Title: #255: Use default configuration with missing sssd.conf
Label: +Accepted
URL: https://github.com/SSSD/sssd/pull/255 Title: #255: Use default configuration with missing sssd.conf
jhrozek commented: """ yes, feel free to push """
See the full comment at https://github.com/SSSD/sssd/pull/255#issuecomment-302748782
URL: https://github.com/SSSD/sssd/pull/255 Title: #255: Use default configuration with missing sssd.conf
jhrozek commented: """ * master: * 1732c40287be0ff918e42ae0045aafeee91b3c7b * b7ad403d5068dc4840cdaa175338de885e294ac6 * 87de1e0fb0f1b40bc088540f7a24f0a20fecf618 """
See the full comment at https://github.com/SSSD/sssd/pull/255#issuecomment-303346654
URL: https://github.com/SSSD/sssd/pull/255 Author: lslebodn Title: #255: Use default configuration with missing sssd.conf Action: closed
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/255/head:pr255 git checkout pr255
URL: https://github.com/SSSD/sssd/pull/255 Title: #255: Use default configuration with missing sssd.conf
Label: +Pushed
sssd-devel@lists.fedorahosted.org
-
jhrozek -
lslebodn
-
pbrezina