<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 08/28/2014 06:51 PM, Sumit Bose
wrote:<br>
</div>
<blockquote cite="mid:20140828165120.GF16631@localhost.localdomain"
type="cite">
<pre wrap="">On Thu, Aug 14, 2014 at 07:18:40PM +0200, thierry bordaz wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hello,
Following Petr remarks from the previous review, I modified the
original fix to move it only in '.update' files.
Thanks
thierry
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">From d45e78dfeb7761348c464b3bb3956656bb115ce0 Mon Sep 17 00:00:00 2001
From: "Thierry bordaz (tbordaz)" <a class="moz-txt-link-rfc2396E" href="mailto:tbordaz@redhat.com"><tbordaz@redhat.com></a>
Date: Thu, 7 Aug 2014 16:29:02 +0200
Subject: [PATCH] User Life Cycle: create containers and scoping DS plugins
User Life Cycle is designed <a class="moz-txt-link-freetext" href="http://www.freeipa.org/page/V4/User_Life-Cycle_Management">http://www.freeipa.org/page/V4/User_Life-Cycle_Management</a>
It manages 3 containers (Staging, Active, Delete). At install/upgrade Delete and Staging
containers needs to be created.
Active: cn=users,cn=accounts,$SUFFIX
Delete: cn=deleted users,cn=accounts,cn=provisioning,$SUFFIX
Stage: cn=staged users ,cn=accounts,cn=provisioning,$SUFFIX
Plugins scopes:
krbPrincipalName, krbCanonicalName, ipaUniqueID, uid:
cn=accounts,SUFFIX
cn=deleted users,cn=accounts,cn=provisioning,SUFFIX
DNA:
cn=accounts,SUFFIX
</pre>
</blockquote>
<pre wrap="">
Hi Thierry,
sorry for being late, but cn=accounts,SUFFIX is too strict for the DNA
plugin. We need to generate a UID for the trusted domain objects as
well which are stored in cn=trusts,SUFFIX. The reason is that AD
expects to be able to connect with a special trusted domain account. We
generate this account on the fly based on the data in the trusted domain
object hence we need a UID here.
Since it looks like dnaScope is a SINGLE-VALUE attribute I think
dnaScope has to be reverted to SUFFIX. Do you see any drawbacks or a
different solution?
bye,
Sumit</pre>
</blockquote>
<br>
Hello Sumit,<br>
<br>
<blockquote>Thank you so much for having reviewed this fix and your
important feedback !<br>
<br>
Yes I had the same fear to restrict DNA to 'accounts'. I opened
<a class="moz-txt-link-freetext" href="https://fedorahosted.org/389/ticket/47828">https://fedorahosted.org/389/ticket/47828</a><br>
to allow to exclude a part of the DIT (here
'cn=provisioning,SUFFIX') from the scope of DNA plugin.<br>
Do you think it can address this concern ?<br>
<br>
thanks<br>
thierry<br>
</blockquote>
<blockquote cite="mid:20140828165120.GF16631@localhost.localdomain"
type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
Plugins exclude subtree:
IPA UUID, Referential Integrity, memberOf:
cn=provisioning,SUFFIX
Reviewed-By: Petr Viktorin <a class="moz-txt-link-rfc2396E" href="mailto:pviktori@redhat.com"><pviktori@redhat.com></a>
<a class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa/ticket/3813">https://fedorahosted.org/freeipa/ticket/3813</a>
---
</pre>
</blockquote>
</blockquote>
<br>
</body>
</html>