Re: urpmi and ldap

Le Jeudi 19 Mai 2005 14:45, Buchan Milne a =E9crit=A0:
> Michael Scherer wrote:
> > Le Mardi 17 Mai 2005 09:19, Buchan Milne a =E9crit :
> >>Such as the commented out objectidentifier (which is all that would need
> >>to be changed if we can get an oid arc from flepied).
> >
> > I didn't asked yet, we should first finish the schema.
>
> Sure, but the previous schema wouldn't load up on my LDAP server, and
> now it's *really* trivial to change it when it can be finalised.

Yes, of course.
Is there nothing to add to the scheme, you think we can propose it ?

> >>>>For dns-autoconfiguration, I don't think the OpenLDAP libs support it
> >>>>(but pam_ldap and nss_ldap do to some extent, though I am not sure
> >>>>about autofs and sudo - which use /etc/ldap.conf as well ...).
> >>>>
> >>>>So, I'll need to think about this some more.
> >>>
> >>>It would be nice to have a common way to autoconfigure, using srv
> >>>record, we just need to agree with other people about the name ( and
> >>>the need )
> >>
> >>I don't see the need to be able to locate anything but the LDAP server
> >>(assuming the BASEDN is configured somewhere already, as it will have to
> >>be anyway).
> >
> > If we need to add the basedn by hand, we could also add the ldap server
> > at the same time, so what is the interest ?
>
> The basedn will not change ... however the LDAP server could be
> different (based on location for instance).

Indeed.=20
Since the config file could be placed on installation, maybe there is no ne=
ed=20
for basedn auto configuration. Maybe I read too much thing about zeroconf a=
nd=20
macos X :) =20
( http://images.apple.com/server/pdfs/Workgroup_Manager_TB_v10.4.pdf, page =
6 )

> >>>Either we use srv record to give the server and other informations, or
> >>>we use the dns to give the url of the file to download with the
> >>>configuration ( like ie proxy detection http://www.wlug.org.nz/WPAD ).
> >>
> >>This looks partially broken compared to using a SRV record IMHO (since
> >>you could have collisions with a host with a short hostname of 'wpad',
> >>which the use of SRV records prevents).
> >>
> >>$ dig +short @win2k3 _ldap._tcp.hp441.co.za SRV
> >>0 100 389 win2k3.hp441.co.za.
> >>
> >>IMHO, WPAD would be better if it used something like a SRV record for
> >>webcache (ie _webcache._tcp)
> >
> > Yes, of course, a fixed name is bad, but what about using SRV record to
> > store the url of the config file ?
>
> SRV records should be:
> $priority $weight $port $hostname
>
> (this url may be of interest:
> http://www.microsoft.com/resources/documentation/Windows/2000/server/resk=
it
>/en-us/Default.asp?url=3D/resources/documentation/Windows/2000/server/resk=
it/e
>n-us/distrib/dsbc_nar_sdns.asp)

Ok, so, what should we choose for srv record ?

Is there something "standard" for this ?
Would it be useful to have a config item for this ?

And we still need to add round robin support.


> >>>What would be nice also is to use the same system with $ARCH/$VERSION =
in
> >>>the ldap config file, especially with the filter.
> >>
> >>I was thinking that myself ... although for now $ARCH/$VERSION support
> >>in the url attribute may be enough (and, I guess it may work already),
> >>depending on the mirror.
> >
> > Adding support for domain name  would also be nice i think ( and easy ).
> >
> > With a substitution on the filter, we could have something like :
> >
> > base_filter=3D"(&(objectClass=3DurpmiRepository)(associatedDomain=3D$DO=
MAIN)"
>
> Hmm, not very many of me entries have an associatedDomain attribute.

Adding $domain support is easy, this is just a difference case of $HOST.
And we can already use hostname and a anonymous ldap for this.

> Additionally, I think we need to consider a scheme that would be useful
> for all software using LDAP for configuration (which hopefully someday
> will include KDE/GNOME etc).
>
> My idea was that we should be able to get to the point where every host
> has an entry in LDAP (and, be able to authenticate to the LDAP server
> using a Kerberos keytab file). Then, host-specific configurations could
> be dependant on the group memberships of the host ...
>
> So, the host would do an ldapsearch to determine its dn (ie ldapwhoami),
> then search (&(objectclass=3Dgroup)(member=3D$dn)), and then search the
> groups for configurations.

Ok, we could also add support for this :=20

$dn =3D> `ldapwhoami -x` or $user=20
 ( if $user  in ldap config file  ).

Would it be sufficient, or this need more information  ?


> > Then, all computer named roomX.firstgrade.student.example.com would fet=
ch
> > student hdlists, and roomY.secondgrade.student.example.com would fetch
> > other hdlist, based on the filtering, and on associatedDomain.
> >
> >>Another thing ... how about adding LDIF support to urpmi-web (user to
> >>provide the basedn).
> >
> > Can you elaborate ?
>
> Well, to generate this:
> >>http://www.zarb.org/~bgmilne/obsidian-urpmi.ldif
>
> I went to urpmi-addmedia.org, chose my mirrors, and then added the
> information to the relevant attributes etc
>
> The only information in the LDIF (besides the proxy, which isn't taken
> into account directly by urpmi yet) that was not known already was the
> basedn (in this case cn=3Durpmi,cn=3DConfig,ou=3DHosts,dc=3Dobsidian,dc=
=3Dco,dc=3Dza).
>
> So, a checkbox for "Generate LDIF for urpmi-ldap" and a field to enter a
> basedn would be nice ....

This is quite specialized, but it would be easier to add than .urpmi-media=
=20
file.
( http://qa.mandriva.com/twiki/bin/view/Main/CreateRepository#Providing_a_e=
asy_way_to_add_your ).

Just ask to easy urpmi people ( nanardon, trem, at zarb.org ).

=2D-=20
Michael Scherer