Re: urpmi and ldap

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Michael Scherer wrote:
> Le Jeudi 19 Mai 2005 14:45, Buchan Milne a écrit :
> 
>>Michael Scherer wrote:
>>
>>>Le Mardi 17 Mai 2005 09:19, Buchan Milne a écrit :
>>>
>>>>Such as the commented out objectidentifier (which is all that would need
>>>>to be changed if we can get an oid arc from flepied).
>>>
>>>I didn't asked yet, we should first finish the schema.
>>
>>Sure, but the previous schema wouldn't load up on my LDAP server, and
>>now it's *really* trivial to change it when it can be finalised.
> 
> 
> Yes, of course.
> Is there nothing to add to the scheme, you think we can propose it ?

I think so ...

My only concern is that if we (or others) start adding LDAP support to
lots of apps ... each with custom schema ... we're going to end up with
*lots* of schema, meaning schema-aware applications will need to
transfer a lot of data to get the schema ... and if we need to have fast
searches, we may need to index a lot more attributes (incurring a
performance hit, and using addtional disk space).

And, not very many of the attributes actually need to be searchable.

So, I think it would be more useful to have a more generic schema:


cn=10_2_main,ou=urpmi,ou=configuration,ou=Hosts,$dn
objectclass: softwareConfiguration
softwareName: urpmi
softwareVersion: 10.2
configurationClass: medium
uri: http://foo/path/etc
cn: 10_2_main
configurationEntry: hdlist=10_2_main.hdlist.cz
configurationEntry: withhdlist=path/to/hdlist.cz
configurationEntry: http_proxy=http://proxy:8080

So, instead of a search for
(&(objectClass=urpmiRepository)(cn=10_2_main)), you would do a search
for
(&(objectClass=softwareConfiguration)(softwareName=urpmi)(softwareVersion=10.2))

But, this would only be useful if we have more software that would use a
schema like this.

>>>>>>For dns-autoconfiguration, I don't think the OpenLDAP libs support it
>>>>>>(but pam_ldap and nss_ldap do to some extent, though I am not sure
>>>>>>about autofs and sudo - which use /etc/ldap.conf as well ...).
>>>>>>
>>>>>>So, I'll need to think about this some more.
>>>>>
>>>>>It would be nice to have a common way to autoconfigure, using srv
>>>>>record, we just need to agree with other people about the name ( and
>>>>>the need )
>>>>
>>>>I don't see the need to be able to locate anything but the LDAP server
>>>>(assuming the BASEDN is configured somewhere already, as it will have to
>>>>be anyway).
>>>
>>>If we need to add the basedn by hand, we could also add the ldap server
>>>at the same time, so what is the interest ?
>>
>>The basedn will not change ... however the LDAP server could be
>>different (based on location for instance).
> 
> 
> Indeed. 
> Since the config file could be placed on installation, maybe there is no need 
> for basedn auto configuration. Maybe I read too much thing about zeroconf and 
> macos X :)  
> ( http://images.apple.com/server/pdfs/Workgroup_Manager_TB_v10.4.pdf, page 6 )
> 

Thanks, I'll take a look at that.

But, remember, we don't really want to produce a setup which could be
easily exploited (ie by having someone plug your laptop into a network
which has DNS/LDAP etc configured, and have your machine trust
everything enough to let someone log in).

There has to be at least some configuration that must be done manually
that will guarantee the security of the system ... maybe SSL CA cert
would be best/easiest?

> 
>>>>>Either we use srv record to give the server and other informations, or
>>>>>we use the dns to give the url of the file to download with the
>>>>>configuration ( like ie proxy detection http://www.wlug.org.nz/WPAD ).
>>>>
>>>>This looks partially broken compared to using a SRV record IMHO (since
>>>>you could have collisions with a host with a short hostname of 'wpad',
>>>>which the use of SRV records prevents).
>>>>
>>>>$ dig +short @win2k3 _ldap._tcp.hp441.co.za SRV
>>>>0 100 389 win2k3.hp441.co.za.
>>>>
>>>>IMHO, WPAD would be better if it used something like a SRV record for
>>>>webcache (ie _webcache._tcp)
>>>
>>>Yes, of course, a fixed name is bad, but what about using SRV record to
>>>store the url of the config file ?
>>
>>SRV records should be:
>>$priority $weight $port $hostname
>>
>>(this url may be of interest:
>>http://www.microsoft.com/resources/documentation/Windows/2000/server/reskit
>>/en-us/Default.asp?url=/resources/documentation/Windows/2000/server/reskit/e
>>n-us/distrib/dsbc_nar_sdns.asp)
> 
> 
> Ok, so, what should we choose for srv record ?

For WPAD? Or something related to urpmi (which I don't think needs
anything else auto-configured, if it can find the LDAP server, and we
want to manually choose the basedn ..).

> Is there something "standard" for this ?
> Would it be useful to have a config item for this ?
> 
> And we still need to add round robin support.

SRV records already provide for that via the priority and weight. You
should cater for multiple answers ... take the ones with the lowest
priority, and then the ones with the highest weight (I think), and then
if you still have more than one, take a random one.

>>>>>What would be nice also is to use the same system with $ARCH/$VERSION in
>>>>>the ldap config file, especially with the filter.
>>>>
>>>>I was thinking that myself ... although for now $ARCH/$VERSION support
>>>>in the url attribute may be enough (and, I guess it may work already),
>>>>depending on the mirror.
>>>
>>>Adding support for domain name  would also be nice i think ( and easy ).
>>>
>>>With a substitution on the filter, we could have something like :
>>>
>>>base_filter="(&(objectClass=urpmiRepository)(associatedDomain=$DOMAIN)"
>>
>>Hmm, not very many of me entries have an associatedDomain attribute.
> 
> 
> Adding $domain support is easy, this is just a difference case of $HOST.
> And we can already use hostname and a anonymous ldap for this.
> 
> 
>>Additionally, I think we need to consider a scheme that would be useful
>>for all software using LDAP for configuration (which hopefully someday
>>will include KDE/GNOME etc).
>>
>>My idea was that we should be able to get to the point where every host
>>has an entry in LDAP (and, be able to authenticate to the LDAP server
>>using a Kerberos keytab file). Then, host-specific configurations could
>>be dependant on the group memberships of the host ...
>>
>>So, the host would do an ldapsearch to determine its dn (ie ldapwhoami),
>>then search (&(objectclass=group)(member=$dn)), and then search the
>>groups for configurations.
> 
> 
> Ok, we could also add support for this : 
> 
> $dn => `ldapwhoami -x` or $user 
>  ( if $user  in ldap config file  ).

I was thinking more of the situation without "-x", aka SASL, aka GSS-API
(kerberos).


> Would it be sufficient, or this need more information  ?

I think it should be sufficient ... but it means users need to set up
additional information, and it should be easy to do this (aka choosing
the - currently non-existent - "LDAP + Kerberos" option in drakauth
should create an LDAP entry for the host and retrieve the keytab).

>>>Then, all computer named roomX.firstgrade.student.example.com would fetch
>>>student hdlists, and roomY.secondgrade.student.example.com would fetch
>>>other hdlist, based on the filtering, and on associatedDomain.
>>>
>>>
>>>>Another thing ... how about adding LDIF support to urpmi-web (user to
>>>>provide the basedn).
>>>
>>>Can you elaborate ?
>>
>>Well, to generate this:
>>
>>>>http://www.zarb.org/~bgmilne/obsidian-urpmi.ldif
>>
>>I went to urpmi-addmedia.org, chose my mirrors, and then added the
>>information to the relevant attributes etc
>>
>>The only information in the LDIF (besides the proxy, which isn't taken
>>into account directly by urpmi yet) that was not known already was the
>>basedn (in this case cn=urpmi,cn=Config,ou=Hosts,dc=obsidian,dc=co,dc=za).
>>
>>So, a checkbox for "Generate LDIF for urpmi-ldap" and a field to enter a
>>basedn would be nice ....
> 
> 
> This is quite specialized, but it would be easier to add than .urpmi-media 
> file.
> ( http://qa.mandriva.com/twiki/bin/view/Main/CreateRepository#Providing_a_easy_way_to_add_your ).
> 
> Just ask to easy urpmi people ( nanardon, trem, at zarb.org ).

OK ... next week ... I'm late already.

Regards,
Buchan

- --
Buchan Milne                      Senior Support Technician
Obsidian Systems                  http://www.obsidian.co.za
B.Eng          RHCE (803004789010797),LPIC-1 (LPI000074592)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCjiSarJK6UGDSBKcRAgoEAJ9oDpfTTE63/ngI+0zabd3JMaXgiQCgmfCI
2lhSQ3778KIJHEgRlsz0i4M=
=FTvK
-----END PGP SIGNATURE-----