[Freeipa-devel] [DESIGN] Server Roles

[Martin Kosek]

On 03/17/2016 06:16 PM, Martin Babinsky wrote:
> Hi list,
> 
> here is a link (http://www.freeipa.org/page/V4/Server_Roles) to WIP design
> document concerning the concept of Server Roles as a user-friendly abstraction
> of the services running on IPA masters.
> 
> The main aim of this feature is to provide a higher level interface to query
> and manipulate service-related information stored in dirsrv backend.
> 
> I have not touched the design much from the post-Devconf session, mainly
> because there are some points to clarify and agree upon.

Initial thoughts:

* Use Cases: these are rather vague points what you want to implement. In Use
Case section, I would like to see what specific *user* use cases you are
addressing, i.e. what user problems you are solving. Ideally in a form of a
user story. Like here:

http://www.freeipa.org/page/V4/User_Life-Cycle_Management#Use_Cases
or here:
http://www.freeipa.org/page/V4/Authentication_Indicators#Use_Cases
or here:
http://www.freeipa.org/page/V4/External_trust_to_AD#Use_Cases

> I have the following points to discuss:
> 
> 1.) the design assumes that there is a distinction between roles such as DNS
> server, CA, etc. and the more specific sub-roles such as DNSSec key master, CRL
> master, etc. Now in the hindsight I think this distinction is quite artificial
> and just clutters the interface unnecessarily. We might implement this kind of
> hierarchy in the code itself but that is something the user needs not be aware of.

Well, there are dependencies. A server cannot be a CRL master without also
being a CA role. I assume same applies to DNSSEC master.

I think we need to think more about distinguishing what is role, what is just
an attribute of a role, etc. AD for example distinguishes roles, role service
and features:

https://technet.microsoft.com/en-us/library/cc754923.aspx

Martin