Re: urpmi and ldap

Le Mardi 17 Mai 2005 09:19, Buchan Milne a =E9crit=A0:
> Michael Scherer wrote:
> > On Monday 16 May 2005 18:37, Buchan Milne wrote:
> >>Michael Scherer wrote:
> >>>Hi.
> >>>As already said on this list, I was working on a ldap enabled
> >>>urpmi.
> >>>
> >>>Well, good news, it works : http://www.zarb.org/~misc/urpmi-ldap/.
> >>>
> >>>Even better, you can deploy it on LE2005/10.2 without patch or
> >>>anything, and update the module without change. In the future, we
> >>>could even place it in a rpm usable on this release.
> >>>
> >>>There is a minimal doc,  a  schema using private oid,
> >>
> >>Hmm, 1.1.1 isn't really private, quoting from rfc 3383:
> >>
> >>"
> >>   To avoid interoperability problems between early implementations
> >>of "works in progress" and implementations of the published
> >>   specification (e.g., the RFC), experimental OIDs SHOULD be used in
> >>   "works in progress" and early implementations.  OIDs under the
> >>   Internet Experimental OID arc (1.3.6.1.3.x) may be used for this
> >>   purpose.
> >>"
> >>
> >>See attached patch ...
> >
> > Applied by rafael on cvs.
> > We will need to change it to something more official  once we ironed all
> > bugs.
>
> Such as the commented out objectidentifier (which is all that would need
> to be changed if we can get an oid arc from flepied).

I didn't asked yet, we should first finish the schema.

> >>>and i didn't tested more
> >>>than urpmq.
> >>
> >>I couldn't urpmi.update until I made the other change in the patch.
> >
> > the cn stuff ?
>
> No, this one:
>
> -            $urpm->write_ldap_cache($medium) or $urpm->{log}(N("Could
> not write ldap cache : ") . $_ );
> +            $urpm->urpm::ldap::write_ldap_cache($medium) or
> $urpm->{log}(N("Could not write ldap cache : ") . $_ );
>
> > applied too by rgs. I will use a clean openldap server next time.
> >
> > I am not a expert in ldap schema, but cn shouldn't be listed in "must"
> > instead of "may"  ?
>
> Yes, if we're going to use it as the naming attributes ...

It seems to be required, so having source name would be redundant.

> > And maybe we should remove the source-name and use cn instead ?
>
> Probably ...

Ok, if there is no objection, I will change it this evening.

> >>>There is also some know problem, like hdlist being left when you
> >>>change the sources.
> >>>I think a urpmi.clean utility ( something that clean
> >>>/var/lib/urpmi/* from spurious files )  would be a solution,
> >>>
> >>>I will also add the missing features ( autoconfiguration from dns )
> >>>later once someone ( buchan ) give me guidelines.
> >>
> >>urpmi-ldap should also use upper-case for configuration items from
> >>/etc/openldap/ldap.conf (OpenLDAP libs use upper-case,
> >>nss_ldap/pam_ldap use lower case and fall back to the upper-case ones
> >>AFAIK), or use /etc/ldap.conf
> >>
> >>Since some of the items we might need are not valid for OpenLDAP
> >>libs, I changed to use /etc/ldap.conf
> >
> > ldap.conf is for pam_ldap and the other is for openldap library ?
> > I tought they were the same ?
>
> They used to be, but that was a Mandrake-specific patch ... and the
> OpenLDAP people didn't like it (having people posting nss_ldap/pam_ldap
> configuration entries to the OpenLDAP list) ... so I dropped the patch.
>
> BTW, playing with some SSL settings ... I found sudo seems to use only
> /etc/ldap.conf ...
>
> > Anyway, I applied to cvs.
> >
> >>For dns-autoconfiguration, I don't think the OpenLDAP libs support it
> >>(but pam_ldap and nss_ldap do to some extent, though I am not sure
> >>about autofs and sudo - which use /etc/ldap.conf as well ...).
> >>
> >>So, I'll need to think about this some more.
> >
> > It would be nice to have a common way to autoconfigure, using srv
> > record, we just need to agree with other people about the name ( and
> > the need )
>
> I don't see the need to be able to locate anything but the LDAP server
> (assuming the BASEDN is configured somewhere already, as it will have to
> be anyway).

If we need to add the basedn by hand, we could also add the ldap server at =
the=20
same time, so what is the interest ?

> > Either we use srv record to give the server and other informations, or
> > we use the dns to give the url of the file to download with the
> > configuration ( like ie proxy detection http://www.wlug.org.nz/WPAD ).
>
> This looks partially broken compared to using a SRV record IMHO (since
> you could have collisions with a host with a short hostname of 'wpad',
> which the use of SRV records prevents).
>
> $ dig +short @win2k3 _ldap._tcp.hp441.co.za SRV
> 0 100 389 win2k3.hp441.co.za.
>
> IMHO, WPAD would be better if it used something like a SRV record for
> webcache (ie _webcache._tcp)

Yes, of course, a fixed name is bad, but what about using SRV record to sto=
re=20
the url of the config file ?

> > What would be nice also is to use the same system with $ARCH/$VERSION in
> > the ldap config file, especially with the filter.
>
> I was thinking that myself ... although for now $ARCH/$VERSION support
> in the url attribute may be enough (and, I guess it may work already),
> depending on the mirror.

Adding support for domain name  would also be nice i think ( and easy ).

With a substitution on the filter, we could have something like :

base_filter=3D"(&(objectClass=3DurpmiRepository)(associatedDomain=3D$DOMAIN=
)"

Then, all computer named roomX.firstgrade.student.example.com would fetch=20
student hdlists, and roomY.secondgrade.student.example.com would fetch othe=
r=20
hdlist, based on the filtering, and on associatedDomain.

> Another thing ... how about adding LDIF support to urpmi-web (user to
> provide the basedn).

Can you elaborate ?

> For people who didn't see some of this stuff on IRC ... I also uploaded
> the LDIF we're using here:
>
> http://www.zarb.org/~bgmilne/obsidian-urpmi.ldif
>
> Finally, I thought this /. article may provide some motivation:
> http://ask.slashdot.org/article.pl?sid=3D05/05/16/132238&tid=3D164&tid=3D=
185&tid=3D
>201&tid=3D4
>
> (although its a bit short on accurate answers for anything besides Debian=
).

And even on debian, their answers is apt-get update and apt-get upgrade.

=2D-=20
Michael Scherer