Re: urpmi and ldap

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Michael Scherer wrote:
> On Monday 16 May 2005 18:37, Buchan Milne wrote:
> 
>>Michael Scherer wrote:
>>
>>>Hi.
>>>As already said on this list, I was working on a ldap enabled
>>>urpmi.
>>>
>>>Well, good news, it works : http://www.zarb.org/~misc/urpmi-ldap/.
>>>
>>>Even better, you can deploy it on LE2005/10.2 without patch or
>>>anything, and update the module without change. In the future, we
>>>could even place it in a rpm usable on this release.
>>>
>>>There is a minimal doc,  a  schema using private oid,
>>
>>Hmm, 1.1.1 isn't really private, quoting from rfc 3383:
>>
>>"
>>   To avoid interoperability problems between early implementations
>>of "works in progress" and implementations of the published
>>   specification (e.g., the RFC), experimental OIDs SHOULD be used in
>>   "works in progress" and early implementations.  OIDs under the
>>   Internet Experimental OID arc (1.3.6.1.3.x) may be used for this
>>   purpose.
>>"
>>
>>See attached patch ...
> 
> 
> Applied by rafael on cvs.
> We will need to change it to something more official  once we ironed all 
> bugs.

Such as the commented out objectidentifier (which is all that would need
to be changed if we can get an oid arc from flepied).

>>>and i didn't tested more
>>>than urpmq.
>>
>>I couldn't urpmi.update until I made the other change in the patch.
> 
> 
> the cn stuff ?

No, this one:

- -            $urpm->write_ldap_cache($medium) or $urpm->{log}(N("Could
not write ldap cache : ") . $_ );
+            $urpm->urpm::ldap::write_ldap_cache($medium) or
$urpm->{log}(N("Could not write ldap cache : ") . $_ );

> applied too by rgs. I will use a clean openldap server next time.
> 
> I am not a expert in ldap schema, but cn shouldn't be listed in "must" 
> instead of "may"  ?

Yes, if we're going to use it as the naming attributes ...

> And maybe we should remove the source-name and use cn instead ?

Probably ...

>>>There is also some know problem, like hdlist being left when you
>>>change the sources.
>>>I think a urpmi.clean utility ( something that clean
>>>/var/lib/urpmi/* from spurious files )  would be a solution,
>>>
>>>I will also add the missing features ( autoconfiguration from dns )
>>>later once someone ( buchan ) give me guidelines.
>>
>>urpmi-ldap should also use upper-case for configuration items from
>>/etc/openldap/ldap.conf (OpenLDAP libs use upper-case,
>>nss_ldap/pam_ldap use lower case and fall back to the upper-case ones
>>AFAIK), or use /etc/ldap.conf
>>
>>Since some of the items we might need are not valid for OpenLDAP
>>libs, I changed to use /etc/ldap.conf
> 
> 
> ldap.conf is for pam_ldap and the other is for openldap library ?
> I tought they were the same ?

They used to be, but that was a Mandrake-specific patch ... and the
OpenLDAP people didn't like it (having people posting nss_ldap/pam_ldap
configuration entries to the OpenLDAP list) ... so I dropped the patch.

BTW, playing with some SSL settings ... I found sudo seems to use only
/etc/ldap.conf ...

> Anyway, I applied to cvs.
> 
> 
>>For dns-autoconfiguration, I don't think the OpenLDAP libs support it
>>(but pam_ldap and nss_ldap do to some extent, though I am not sure
>>about autofs and sudo - which use /etc/ldap.conf as well ...).
>>
>>So, I'll need to think about this some more.
> 
> 
> It would be nice to have a common way to autoconfigure, using srv 
> record, we just need to agree with other people about the name ( and 
> the need )

I don't see the need to be able to locate anything but the LDAP server
(assuming the BASEDN is configured somewhere already, as it will have to
be anyway).

> Either we use srv record to give the server and other informations, or 
> we use the dns to give the url of the file to download with the 
> configuration ( like ie proxy detection http://www.wlug.org.nz/WPAD ).

This looks partially broken compared to using a SRV record IMHO (since
you could have collisions with a host with a short hostname of 'wpad',
which the use of SRV records prevents).

$ dig +short @win2k3 _ldap._tcp.hp441.co.za SRV
0 100 389 win2k3.hp441.co.za.

IMHO, WPAD would be better if it used something like a SRV record for
webcache (ie _webcache._tcp)

> What would be nice also is to use the same system with $ARCH/$VERSION in 
> the ldap config file, especially with the filter.

I was thinking that myself ... although for now $ARCH/$VERSION support
in the url attribute may be enough (and, I guess it may work already),
depending on the mirror.

Another thing ... how about adding LDIF support to urpmi-web (user to
provide the basedn).

For people who didn't see some of this stuff on IRC ... I also uploaded
the LDIF we're using here:

http://www.zarb.org/~bgmilne/obsidian-urpmi.ldif

Finally, I thought this /. article may provide some motivation:
http://ask.slashdot.org/article.pl?sid=05/05/16/132238&tid=164&tid=185&tid=201&tid=4

(although its a bit short on accurate answers for anything besides Debian).

Regards,
Buchan

- --
Buchan Milne                      Senior Support Technician
Obsidian Systems                  http://www.obsidian.co.za
B.Eng          RHCE (803004789010797),LPIC-1 (LPI000074592)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCiZsNrJK6UGDSBKcRAn3HAKC9gQFTYrxWeLpjUNLr+W9Twy9z/ACgrkjY
YkD/5p3x2ht4NV63PCE5yg0=
=YV6G
-----END PGP SIGNATURE-----