RFC: Expose different identity domains to different D-BUS consumers

[Pavel Březina]

https://fedorahosted.org/sssd/ticket/2187

My idea is as follows:

- create new option 'domains' in [ifp] sections
- this option can reduce number of domains set in 'domains' in [sssd] 
section
- provide this reduced domains set to rctx->domains

[sssd]
domains = A, B, C

[ifp]
domains = B

rctx->domains would contain only B in ifp responder.

But I am not sure if it fulfills the requirement.

[Dmitri Pal]

On 05/21/2015 06:22 AM, Pavel Březina wrote:
>  https://fedorahosted.org/sssd/ticket/2187
>
>  My idea is as follows:
>
>  - create new option 'domains' in [ifp] sections
>  - this option can reduce number of domains set in 'domains' in [sssd] 
>  section
>  - provide this reduced domains set to rctx->domains
>
>  [sssd]
>  domains = A, B, C
>
>  [ifp]
>  domains = B
>
>  rctx->domains would contain only B in ifp responder.
>
>  But I am not sure if it fulfills the requirement. 
IMO it should be similar to 
https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM but 
for IFP.
The design above does not address the requirement.


-- 
Thank you,
Dmitri Pal

Director of Engineering for IdM portfolio
Red Hat, Inc.

[Jakub Hrozek]

On Thu, May 21, 2015 at 09:26:28AM -0400, Dmitri Pal wrote:
>  On 05/21/2015 06:22 AM, Pavel Březina wrote:
>  >https://fedorahosted.org/sssd/ticket/2187
>  >
>  >My idea is as follows:
>  >
>  >- create new option 'domains' in [ifp] sections
>  >- this option can reduce number of domains set in 'domains' in [sssd]
>  >section
>  >- provide this reduced domains set to rctx->domains
>  >
>  >[sssd]
>  >domains = A, B, C
>  >
>  >[ifp]
>  >domains = B
>  >
>  >rctx->domains would contain only B in ifp responder.
>  >
>  >But I am not sure if it fulfills the requirement.
>  
>  IMO it should be similar to
>  https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM but for
>  IFP.
>  The design above does not address the requirement. 
Yes.

Long-term, we should really consider polkit instead of just using UIDs
in sssd.conf.

[Pavel Březina]

On 05/22/2015 11:26 AM, Jakub Hrozek wrote:
>  On Thu, May 21, 2015 at 09:26:28AM -0400, Dmitri Pal wrote:
> > On 05/21/2015 06:22 AM, Pavel Březina wrote:
> >> https://fedorahosted.org/sssd/ticket/2187
> >>
> >> My idea is as follows:
> >>
> >> - create new option 'domains' in [ifp] sections
> >> - this option can reduce number of domains set in 'domains' in [sssd]
> >> section
> >> - provide this reduced domains set to rctx->domains
> >>
> >> [sssd]
> >> domains = A, B, C
> >>
> >> [ifp]
> >> domains = B
> >>
> >> rctx->domains would contain only B in ifp responder.
> >>
> >> But I am not sure if it fulfills the requirement.
> >
> > IMO it should be similar to
> > https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM but for
> > IFP.
> > The design above does not address the requirement.
>
>  Yes.
>
>  Long-term, we should really consider polkit instead of just using UIDs
>  in sssd.conf. 
Should I dive into polkit and poc it in ifp?

[Jakub Hrozek]

On Fri, May 22, 2015 at 11:28:50AM +0200, Pavel Březina wrote:
>  On 05/22/2015 11:26 AM, Jakub Hrozek wrote:
>  >On Thu, May 21, 2015 at 09:26:28AM -0400, Dmitri Pal wrote:
>  >>On 05/21/2015 06:22 AM, Pavel Březina wrote:
>  >>>https://fedorahosted.org/sssd/ticket/2187
>  >>>
>  >>>My idea is as follows:
>  >>>
>  >>>- create new option 'domains' in [ifp] sections
>  >>>- this option can reduce number of domains set in 'domains' in
> [sssd]
>  >>>section
>  >>>- provide this reduced domains set to rctx->domains
>  >>>
>  >>>[sssd]
>  >>>domains = A, B, C
>  >>>
>  >>>[ifp]
>  >>>domains = B
>  >>>
>  >>>rctx->domains would contain only B in ifp responder.
>  >>>
>  >>>But I am not sure if it fulfills the requirement.
>  >>
>  >>IMO it should be similar to
>  >>https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM but for
>  >>IFP.
>  >>The design above does not address the requirement.
>  >
>  >Yes.
>  >
>  >Long-term, we should really consider polkit instead of just using UIDs
>  >in sssd.conf.
>  
>  Should I dive into polkit and poc it in ifp? 
I say let's first make it useful for Stef's use-case -- IOW make IFP
feature-compatible with AccountService. From the top of my head, we still
need signals, because Cockpit depends on them heavily. Polkit should
come next.

Also please note polkit is on the list of Lennart's software to replace
:-) so before we start using polkit we should check with the systemd
developers if it's a viable option in the long term or if we should just
go with whatever they plan from the start (or both with a compat layer).