Re: [SSSD] [PATCH] Extend the LDAP attribute map with custom options

[Jakub Hrozek]

On Fri, Apr 25, 2014 at 12:05:23PM +0200, Jan Pazdziora wrote:
>  On Fri, Apr 25, 2014 at 11:42:14AM +0200, Jakub Hrozek wrote:
>  > 
>  > I don't really mind too much and appears Jan does not either. So I
>  > simply swapped the order in the attached patches, now it's sysdb:LDAP.
>  > 
>  > Man page was changed accordingly.
>  > 
>  > Jan, could you check if the man page change (src/man/sssd-ldap.5.xml in
>  > the second patch) reads good to you?
>  
>  [...]
>  
>  >  ldap_user_uid_number = str, None, false
>  > diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
>  > index
> f93b418c45d9bcd32499860a858c3f829bb245ca..6426fe4fca5dc9bb9bc84fcbf633404144052d01 100644
>  > --- a/src/man/sssd-ldap.5.xml
>  > +++ b/src/man/sssd-ldap.5.xml
>  > @@ -616,6 +616,54 @@
>  >                      </listitem>
>  >                  </varlistentry>
>  >  
>  > +                <varlistentry>
>  > +                    <term>ldap_user_extra_attrs (string)</term>
>  > +                    <listitem>
>  > +                        <para>
>  > +                            Comma-separated list of LDAP attributes that SSSD
>  > +                            would fetch along with the usual set of user
>  > +                            attributes.
>  > +                        </para>
>  > +                        <para>
>  > +                            The list can either contain LDAP attribute names
>  > +                            only, or colon-separated tuples of SSSD cache
>  > +                            attribute name and LDAP attribute name. In
>  > +                            case only LDAP attribute name is specified,
>  > +                            the attribute is saved to the cache verbatim.
>  > +                            Using a custom SSSD attribute name might be
>  > +                            required by environments that configure several
>  > +                            SSSD domains with different LDAP schemas.
>  > +                        </para>
>  > +                        <para>
>  > +                            Please note that several attribute names are
>  > +                            reserved by SSSD, notably the
> <quote>name</quote>
>  > +                            attribute. SSSD would report an error if any of
>  > +                            the reserved attribute names is used as an extra
>  > +                            attribute name.
>  > +                        </para>
>  > +                        <para>
>  > +                            Examples:
>  > +                        </para>
>  > +                        <para>
>  > +                            ldap_user_extra_attrs = telephoneNumber
>  > +                        </para>
>  > +                        <para>
>  > +                            Save the <quote>telephoneNumber</quote>
> attribute from LDAP
>  > +                            as <quote>telephoneNumber</quote> to the
> cache.
>  > +                        </para>
>  > +                        <para>
>  > +                            ldap_user_extra_attrs = phone:telephoneNumber
>  > +                        </para>
>  > +                        <para>
>  > +                            Save the <quote>telephoneNumber</quote>
> attribute from LDAP
>  > +                            as <quote>phone</quote> to the cache.
>  > +                        </para>
>  > +                        <para>
>  > +                            Default: not set
>  > +                        </para>
>  > +                    </listitem>
>  > +                </varlistentry>
>  
>  It reads very well.
>  
>  Once I have stable .src.rpm, I'll test if the behaviour matches the
>  man page as well. 
Hi,

can I get a final ACK (or a non-file NACK :-)) on the patches?

[PATCH] Extend the LDAP attribute map with custom options

[Jan Pazdziora]

On Mon, Apr 28, 2014 at 10:20:08PM +0200, Jakub Hrozek wrote:
>  
>  can I get a final ACK (or a non-file NACK :-)) on the patches? 
Not sure if you are waiting on ack from me but I confirm that the
.src.rpm you provided me with has the ldap_user_extra_attrs behaviour
as documented, so I can have in [domain/*]

	ldap_user_extra_attrs = email:mail, firstname:givenname, lastname:sn

and in [ifp]

	user_attributes = +email, +firstname, +lastname

a retrieve attribute values from mod_lookup_identity using

	LookupUserAttr email REMOTE_USER_EMAIL " "
	LookupUserAttr firstname REMOTE_USER_FIRSTNAME
	LookupUserAttr lastname REMOTE_USER_LASTNAME

-- 
Jan Pazdziora | adelton at #ipa*, #brno
Principal Software Engineer, Identity Management Engineering, Red Hat

[PATCH] Extend the LDAP attribute map with custom options

[Jakub Hrozek]

On Wed, Apr 30, 2014 at 03:18:11PM +0200, Jan Pazdziora wrote:
>  On Mon, Apr 28, 2014 at 10:20:08PM +0200, Jakub Hrozek wrote:
>  > 
>  > can I get a final ACK (or a non-file NACK :-)) on the patches?
>  
>  Not sure if you are waiting on ack from me but I confirm that the
>  .src.rpm you provided me with has the ldap_user_extra_attrs behaviour
>  as documented, so I can have in [domain/*]
>  
>  	ldap_user_extra_attrs = email:mail, firstname:givenname, lastname:sn
>  
>  and in [ifp]
>  
>  	user_attributes = +email, +firstname, +lastname
>  
>  a retrieve attribute values from mod_lookup_identity using
>  
>  	LookupUserAttr email REMOTE_USER_EMAIL " "
>  	LookupUserAttr firstname REMOTE_USER_FIRSTNAME
>  	LookupUserAttr lastname REMOTE_USER_LASTNAME 
Awesome, thanks a lot for confirmation and testing!

I would prefer to get a code-wise ACK from someone familiar with SSSD
code, though. Thanks to your testing, the reviewer can now only check
out the code.

[PATCH] Extend the LDAP attribute map with custom options

[Pavel Březina]

On 04/30/2014 05:01 PM, Jakub Hrozek wrote:
>  On Wed, Apr 30, 2014 at 03:18:11PM +0200, Jan Pazdziora wrote:
> > On Mon, Apr 28, 2014 at 10:20:08PM +0200, Jakub Hrozek wrote:
> >>
> >> can I get a final ACK (or a non-file NACK :-)) on the patches?
> >
> > Not sure if you are waiting on ack from me but I confirm that the
> > .src.rpm you provided me with has the ldap_user_extra_attrs behaviour
> > as documented, so I can have in [domain/*]
> >
> > 	ldap_user_extra_attrs = email:mail, firstname:givenname, lastname:sn
> >
> > and in [ifp]
> >
> > 	user_attributes = +email, +firstname, +lastname
> >
> > a retrieve attribute values from mod_lookup_identity using
> >
> > 	LookupUserAttr email REMOTE_USER_EMAIL " "
> > 	LookupUserAttr firstname REMOTE_USER_FIRSTNAME
> > 	LookupUserAttr lastname REMOTE_USER_LASTNAME
>
>  Awesome, thanks a lot for confirmation and testing!
>
>  I would prefer to get a code-wise ACK from someone familiar with SSSD
>  code, though. Thanks to your testing, the reviewer can now only check
>  out the code.
>  
Ack.

[PATCH] Extend the LDAP attribute map with custom options

[Jakub Hrozek]

On Fri, May 02, 2014 at 12:30:29PM +0200, Pavel Březina wrote:
>  On 04/30/2014 05:01 PM, Jakub Hrozek wrote:
>  >On Wed, Apr 30, 2014 at 03:18:11PM +0200, Jan Pazdziora wrote:
>  >>On Mon, Apr 28, 2014 at 10:20:08PM +0200, Jakub Hrozek wrote:
>  >>>
>  >>>can I get a final ACK (or a non-file NACK :-)) on the patches?
>  >>
>  >>Not sure if you are waiting on ack from me but I confirm that the
>  >>.src.rpm you provided me with has the ldap_user_extra_attrs behaviour
>  >>as documented, so I can have in [domain/*]
>  >>
>  >>	ldap_user_extra_attrs = email:mail, firstname:givenname, lastname:sn
>  >>
>  >>and in [ifp]
>  >>
>  >>	user_attributes = +email, +firstname, +lastname
>  >>
>  >>a retrieve attribute values from mod_lookup_identity using
>  >>
>  >>	LookupUserAttr email REMOTE_USER_EMAIL " "
>  >>	LookupUserAttr firstname REMOTE_USER_FIRSTNAME
>  >>	LookupUserAttr lastname REMOTE_USER_LASTNAME
>  >
>  >Awesome, thanks a lot for confirmation and testing!
>  >
>  >I would prefer to get a code-wise ACK from someone familiar with SSSD
>  >code, though. Thanks to your testing, the reviewer can now only check
>  >out the code.
>  >
>  
>  Ack. 
Pushed to master:
     4dd38025efda88f123eac672f87d3cda12f050c8
     d2969c6b23c722445bd699c830adb7601ba1cdc6