<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi fellow developers,<br>
<br>
while working on <a class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa/ticket/4263">https://fedorahosted.org/freeipa/ticket/4263</a> I
found some inconsistencies in the attribute naming:<br>
<br>
There are the following attributes in the schema:<br>
<br>
* ipasudorunas_user
<meta name="Description" content="Copy-Paste Buffer">
<meta name="Generator" content="Zim">
: RunAs Users
<meta name="Description" content="Copy-Paste Buffer">
<meta name="Generator" content="Zim">
<br>
*
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
ipasudorunas_group : Groups of RunAs Users
(and not groups you can RunAsGroup as)<br>
<br>
This implies that ipasudorunas prefix implicitly talks about
RunAsUser and not RunAsGroup. This hypothesis is confirmed by
attribute:<br>
<br>
*
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
ipasudorunasgroup_group
<meta name="Description" content="Copy-Paste Buffer">
<meta name="Generator" content="Zim">
:
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
Run with the gid of a specified POSIX group
<meta name="Description" content="Copy-Paste Buffer">
<meta name="Generator" content="Zim">
<br>
<br>
since here the prefix is ipasudorunas<b>group</b>.<br>
<br>
However,<br>
<br>
*
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
ipasudorunasextuser
<meta name="Description" content="Copy-Paste Buffer">
<meta name="Generator" content="Zim">
:
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
RunAs External User (consistent)<br>
* ipasudorunasextgroup :
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
RunAs External Group
<meta name="Description" content="Copy-Paste Buffer">
<meta name="Generator" content="Zim">
(<b>inconsistent</b>, since ipasudorunas prefix means RunAsUser in
other attributes. This attribute naming implies semantics of
"External Groups of RunAs Users" and not "External group you can
RunAsGroup as.").<br>
<br>
The ticket <a class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa/ticket/4263">https://fedorahosted.org/freeipa/ticket/4263</a> calls for
implementation of precisely this "External Groups of RunAs Users".
Since ipasudorunasextgroup attribute is taken, we have the following
alternatives:<br>
<br>
1.) Create new attribute ipasudorunasgroup_extgroup and move
semantics of ipasudorunasextgroup there. This frees
ipasudorunasextgroup for the 4263's use case. (painful)<br>
2.) Create new attribute with incosistent name, such as
ipasudorunasextgroupmembers or ipasudorunasextusergroup.<br>
3.) Do not create new attributes, but use a workaround which adds
failed groups as users with % prefix (patch attached).<br>
<br>
What do you think?<br>
<pre class="moz-signature" cols="72">--
Tomas Babej
Associate Software Engineer | Red Hat | Identity Management
RHCE | Brno Site | IRC: tbabej | freeipa.org </pre>
</body>
</html>