<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <br> Please contact me on IRC (pspacek in #freeipa @ FreeNode) or via e-mail. We need to coordinate, because bind-dyndb-ldap is undergoing heavy refactoring right now.<br> <br> Also, remember that modification in bind-dyndb-ldap will require modification on FreeIPA side (CLI/WebUI/API).<div class="im"><br></div></blockquote><div><br></div><div>Sure - I'm usually in #freeipa as JHogarth when I'm about ...</div> <div><br></div><div>Yes indeed .. I've been doing quite a bit of work in dns.js the past week or so to expose TTL in general anyway...</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> We can't do this, because definition of *Record attributes is outside of our control. Definitions of these attributes come from<br> <a href="http://drift.uninett.no/nett/ip-nett/dnsattributes.schema" target="_blank">http://drift.uninett.no/nett/<u></u>ip-nett/dnsattributes.schema</a><br> and it is used by BIND DLZ LDAP driver.<div class="im"><br></div></blockquote><div><br></div><div>Ah that's a shame ... it would have been quite a smooth way to handle it but compatibility is of course critical.</div> <div> </div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Could you post some real world examples, please? I would love to see some real world records with real TTLs and statistics.<br> How many names with different TTLs have you?<br> How many names and records have you in total?<div class="im"><br></div></blockquote><div><br></div><div>As one example TXT record and SSHFP to describe a system (and it's fingerprint) having a long TTL since they are unlikely to change and an A record with a shorter TTL for a dynamic DNS scenario with a non-sticky lease.</div> <div><br></div><div>There was a specific issue I was bumping into with this in the past (but not a major one) and became an itch to scratch... especially since BIND zone files would support such a setup but the bind-dyndb-ldap won't ... the disparity was something that niggled at me.</div> <div><br></div><div>In all honesty this is an edge case and since I was planning to dive in anyway I thought I might as well take a look given I have some free time at the moment... The default TTL in bind-dyndb-ldap and the exposing/modifying TTL in the Web UI is not dependent on such behaviour in any way.</div> <div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> This could work, but it has significant overhead. At least indexes in LDAP server could grow rapidly.<br> <br></blockquote><div><br></div><div>That is a legitimate concern for sure...</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> The other problem is that you will lost the uniqueness-check on LDAP side. DNS doesn't allow one record with same name and data to appear multiple times and current attribute-based design prevents this 'for free'.<br> <br></blockquote><div><br></div><div>But you would still be limited to this since there could only be one arecord, txtrecord, etc for a given idnsname with that structure.</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> The other problem is that records in single RRset can't have multiple TTL values. I.e. (under single name) all A records have to have the same TTL, all AAAA records has to have same TTL etc.<br> <br></blockquote><div><br></div><div>Hmm I'll have to check BIND again but I thought that when doing round robin A records (as an example) differing TTL was possible ... but admittedly I've not verified this and this would be an inconsistency if so.</div> <div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Of course, all of these can be handled in bind-dyndb-ldap, but doing so on database side is much more elegant.<div class="im"><br></div></blockquote><div><br></div><div>Agreed on this</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div class="im"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <br> dn: idnsName=bar+dNSTTL=3600,<u></u>idnsName=<a href="http://example.com" target="_blank">example.com</a><br> idnsName: bar<br> dNSTTL: 3600<br> aRecord: 5.6.7.8<br> <br> This way you don't have to change the format of existing attributes nor add<br> new attributes.<br> </blockquote> <br></div> This one is my favourite, but again: It will require refactoring on FreeIPA side. Also, I'm not sure if this could work with BIND DLZ LDAP...<br> <br></blockquote><div><br></div><div>I do like the compound RDN idea but it sounds like it would potentially be a lot of upheaval...</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> To summarize it: Is it worth to spend time on this? I would love to see some real numbers.<br> <br></blockquote><div><br></div><div>Good question! It's an itch I have a couple of weeks to scratch at the moment so there's no 'cost' on my time right now associated with it (although I recognise it increases complexity for the maintainers and QA of course as an after-effect)... but the complexity is fairly high and could potentially touch a lot of areas... </div> <div><br></div><div>The more basic bit of work I was doing (just the exposure and modification of TTL in the UI) would have a far improved cost-benefit ratio and only touches dns.js and dns.py (the latter I propose exposing TTL by default rather than needing --all for it in the API ... it makes the dns.js changes cleaner).</div> <div><br></div><div>Adding the ability to configure default TTL in bind-dyndb-ldap also doesn't need any of the per RRtype stuff so avoids complexity there... </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Thank you for your time and passion!<br><span class="HOEnZb"><font color="#888888"><br></font></span></blockquote><div><br></div><div>Well it's about time the linux world had something like this (rather than the old mish-mash of kerberos, openldap, etc and associated scripts to sort of glue users together that was the previous situation) so I champion it wherever I can! </div> <div><br></div><div>James</div><div> </div></div><br></div></div>