Re: urpmi and ldap

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Michael Scherer wrote:
> Le Mardi 17 Mai 2005 09:19, Buchan Milne a écrit :
> 
>>Such as the commented out objectidentifier (which is all that would need
>>to be changed if we can get an oid arc from flepied).
> 
> 
> I didn't asked yet, we should first finish the schema.

Sure, but the previous schema wouldn't load up on my LDAP server, and
now it's *really* trivial to change it when it can be finalised.

>>>>For dns-autoconfiguration, I don't think the OpenLDAP libs support it
>>>>(but pam_ldap and nss_ldap do to some extent, though I am not sure
>>>>about autofs and sudo - which use /etc/ldap.conf as well ...).
>>>>
>>>>So, I'll need to think about this some more.
>>>
>>>It would be nice to have a common way to autoconfigure, using srv
>>>record, we just need to agree with other people about the name ( and
>>>the need )
>>
>>I don't see the need to be able to locate anything but the LDAP server
>>(assuming the BASEDN is configured somewhere already, as it will have to
>>be anyway).
> 
> 
> If we need to add the basedn by hand, we could also add the ldap server at the 
> same time, so what is the interest ?

The basedn will not change ... however the LDAP server could be
different (based on location for instance).

>>>Either we use srv record to give the server and other informations, or
>>>we use the dns to give the url of the file to download with the
>>>configuration ( like ie proxy detection http://www.wlug.org.nz/WPAD ).
>>
>>This looks partially broken compared to using a SRV record IMHO (since
>>you could have collisions with a host with a short hostname of 'wpad',
>>which the use of SRV records prevents).
>>
>>$ dig +short @win2k3 _ldap._tcp.hp441.co.za SRV
>>0 100 389 win2k3.hp441.co.za.
>>
>>IMHO, WPAD would be better if it used something like a SRV record for
>>webcache (ie _webcache._tcp)
> 
> 
> Yes, of course, a fixed name is bad, but what about using SRV record to store 
> the url of the config file ?

SRV records should be:
$priority $weight $port $hostname

(this url may be of interest:
http://www.microsoft.com/resources/documentation/Windows/2000/server/reskit/en-us/Default.asp?url=/resources/documentation/Windows/2000/server/reskit/en-us/distrib/dsbc_nar_sdns.asp)

>>>What would be nice also is to use the same system with $ARCH/$VERSION in
>>>the ldap config file, especially with the filter.
>>
>>I was thinking that myself ... although for now $ARCH/$VERSION support
>>in the url attribute may be enough (and, I guess it may work already),
>>depending on the mirror.
> 
> 
> Adding support for domain name  would also be nice i think ( and easy ).
> 
> With a substitution on the filter, we could have something like :
> 
> base_filter="(&(objectClass=urpmiRepository)(associatedDomain=$DOMAIN)"

Hmm, not very many of me entries have an associatedDomain attribute.

Additionally, I think we need to consider a scheme that would be useful
for all software using LDAP for configuration (which hopefully someday
will include KDE/GNOME etc).

My idea was that we should be able to get to the point where every host
has an entry in LDAP (and, be able to authenticate to the LDAP server
using a Kerberos keytab file). Then, host-specific configurations could
be dependant on the group memberships of the host ...

So, the host would do an ldapsearch to determine its dn (ie ldapwhoami),
then search (&(objectclass=group)(member=$dn)), and then search the
groups for configurations.

> 
> Then, all computer named roomX.firstgrade.student.example.com would fetch 
> student hdlists, and roomY.secondgrade.student.example.com would fetch other 
> hdlist, based on the filtering, and on associatedDomain.
> 
> 
>>Another thing ... how about adding LDIF support to urpmi-web (user to
>>provide the basedn).
> 
> 
> Can you elaborate ?

Well, to generate this:

>>http://www.zarb.org/~bgmilne/obsidian-urpmi.ldif

I went to urpmi-addmedia.org, chose my mirrors, and then added the
information to the relevant attributes etc

The only information in the LDIF (besides the proxy, which isn't taken
into account directly by urpmi yet) that was not known already was the
basedn (in this case cn=urpmi,cn=Config,ou=Hosts,dc=obsidian,dc=co,dc=za).

So, a checkbox for "Generate LDIF for urpmi-ldap" and a field to enter a
basedn would be nice ....

Regards,
Buchan

- --
Buchan Milne                      Senior Support Technician
Obsidian Systems                  http://www.obsidian.co.za
B.Eng          RHCE (803004789010797),LPIC-1 (LPI000074592)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCjIphrJK6UGDSBKcRAkYRAJ0ZbVy8mSmx6eSi89glxZt75ttwpACeKQ9w
iniDqT1b5cehERBTbROG3Us=
=7wRa
-----END PGP SIGNATURE-----