[Fedora-directory-users] Ideas for fds

[jclowser at unitedmessaging.com]

David Boreham wrote:

>
>> From what I remember, that vpn server searched for the users dn in 
>> uniquemember to find a template entry, and the above is what it is 
>> expecting to find.  How would I set up Roles and CoS entries that 
>> would work without changing the app (is that possible)?  Can I set up 
>> Roles/CoS that would populate the uniquemember attribute of the 
>> vpntemplate entry?  Is that searchable (if I remember correctly, 
>> early versions of CoS didn't allow you to search on cos populated 
>> attributes, later versions might have, and I'm not sure where in that 
>> line FDS is).
>
> Yeah, I don't know about this. I was more interested in the semantics 
> of the
> checkpoint application behavior, which I think are easily implemented 
> with
> role-based cos (the end result is that the user entry has the 
> necessary vpn
> cruft on it directly, with no need to indirect to the template entry 
> at the client end).
>
> If an existing application can be made to simply fetch its per-user 
> parameters
> from attributes on the user's entry , then roles/cos will work fine.

The problem lies in what happens if the user is part of multiple 
templates.  For example, one template may say I can access host 1 and 2 
from 9am to 5pm, and another template may say I can access host 3 (no 
time specification, so any time), etc.  If I use roles to merge all the 
values from all these templates into the users entry, I may get 
something like host 1, 2, and 3 are allowed only from 9am-5pm, depending 
on how the templates are organized/defined by the vendor, which is 
different from what I had intended.  FWIW, as I remember it, the 
checkpoint product did allow these in the users entry, and I think it 
broke if a user was actually part of more than one template, but I was 
trying to speak generically vs a particular product :).

> Just to be clear: I don't expect (nor require) that there are any
> applications that 'support' roles. All the applications need to do
> is to support regular ldap attributes on the user entries.

Sorry - bad wording on my part.  When I say "support roles", that 
includes the case where I can read the info from the users entry as you 
specified.  I think it just comes down to being creating in the use of 
roles, and in some cases, nothing will help.

 - Jeff