From Fedora Project Wiki
< Features
No edit summary |
|||
| (9 intermediate revisions by 3 users not shown) | |||
| Line 4: | Line 4: | ||
<!-- The actual name of your feature page should look something like: Features/Your_Feature_Name. This keeps all features in the same namespace --> | <!-- The actual name of your feature page should look something like: Features/Your_Feature_Name. This keeps all features in the same namespace --> | ||
= | = SSSD improve AD integration <!-- The name of your feature --> = | ||
== Summary == | == Summary == | ||
<!-- A sentence or two summarizing what this feature is and what it will do. This information is used for the overall feature summary page for each release. --> | <!-- A sentence or two summarizing what this feature is and what it will do. This information is used for the overall feature summary page for each release. --> | ||
The next major release of SSSD will include support for more advanced AD features for domain members. This includes site | The next major release of SSSD will include support for more advanced AD features for domain members. This includes support for site discovery, dynamic DNS updates, translating SIDs to names and dynamic discovery of the NetBIOS name of an AD domain. | ||
== Owner == | == Owner == | ||
| Line 20: | Line 18: | ||
<!-- Include you email address that you can be reached should people want to contact you about helping with your feature, status is requested, or technical issues need to be resolved--> | <!-- Include you email address that you can be reached should people want to contact you about helping with your feature, status is requested, or technical issues need to be resolved--> | ||
== Current status == | == Current status == | ||
* Targeted release: [[Releases/19 | Fedora 19 ]] | * Targeted release: [[Releases/19 | Fedora 19 ]] | ||
* Last updated: 2013- | * Last updated: 2013-05-14 | ||
* Percentage of completion: | * Percentage of completion: 100% | ||
* Subtasks finished in the Beta: | |||
** DNS site discovery | |||
** DNS dynamic updates | |||
** Dynamic discovery of NetBIOS domain name | |||
** An interface to translate SID to names or IDs and vice versa | |||
<!-- CHANGE THE "FedoraVersion" TEMPLATES ABOVE TO PLAIN NUMBERS WHEN YOU COMPLETE YOUR PAGE. --> | <!-- CHANGE THE "FedoraVersion" TEMPLATES ABOVE TO PLAIN NUMBERS WHEN YOU COMPLETE YOUR PAGE. --> | ||
== Detailed Description == | == Detailed Description == | ||
<!-- Expand on the summary, if appropriate. A couple sentences suffices to explain the goal, but the more details you can provide the better. --> | <!-- Expand on the summary, if appropriate. A couple sentences suffices to explain the goal, but the more details you can provide the better. --> | ||
So far SSSD development of AD provider concentrated on doing the user and group lookups for the joined domain efficiently with high performance. With the next major release of SSSD support for some features which are specific to AD domain will be added. This includes: | So far SSSD development of AD provider concentrated on doing the user and group lookups for the joined domain efficiently with high performance. With the next major release of SSSD support for some features which are specific to AD domain will be added. This includes: | ||
* Site support: AD domains which include different physical locations can be split into sites. Each site represents a single physical location. With specially crafted DNS service record lookups an AD client can find the nearest domain controller, i.e. the domain controller in its site. This helps to keep network traffic local and allows clients to talk to the server with the lowest latency. | * Site support: AD domains which include different physical locations can be split into sites. Each site represents a single physical location. With specially crafted DNS service record lookups an AD client can find the nearest domain controller, i.e. the domain controller in its site. This helps to keep network traffic local and allows clients to talk to the server with the lowest latency. | ||
* | * DNS updates: AD clients will be able to update their DNS record dynamically if assigned a different IP address | ||
* NetBIOS name discovery: at present, the NetBIOS name must be specified as the SSSD domain name in order to make it possible to look up users using the NetBIOS name. In F-19 the SSSD will enable to discover the NetBIOS name dynamically, allowing the lookups to just work. | |||
* An interface to translate SID identifiers to user or group names or POSIX ID. Such interface will be the basis of future CIFS integration as well as used directly by FreeIPA to provide a human-reasable representation of users and groups. | |||
== Benefit to Fedora == | == Benefit to Fedora == | ||
| Line 43: | Line 45: | ||
All planned features for the next major release of SSSD can be found at [https://fedorahosted.org/sssd/milestone/SSSD%201.10%20beta]. The improvements mentioned above are tracked by the following tickets: | All planned features for the next major release of SSSD can be found at [https://fedorahosted.org/sssd/milestone/SSSD%201.10%20beta]. The improvements mentioned above are tracked by the following tickets: | ||
* [https://fedorahosted.org/sssd/ticket/1032 Site support] | * [https://fedorahosted.org/sssd/ticket/1032 Site support] | ||
* [https://fedorahosted.org/sssd/ticket/1504 DNS updates] | |||
* [https://fedorahosted.org/sssd/ticket/364 Trusted domains] | * [https://fedorahosted.org/sssd/ticket/364 Trusted domains] | ||
* [https://fedorahosted.org/sssd/ticket/ | * [https://fedorahosted.org/sssd/ticket/1468 NetBIOS name discovery] | ||
* [https://fedorahosted.org/sssd/ticket/1559 SID-to-Name interface] | |||
Links to design documents can be found in the tickets. | Links to design documents can be found in the tickets. | ||
| Line 64: | Line 68: | ||
Testing instructions can be found on the design documents in the SSSD wiki mentioned above. In the following a short summary for each feature can be found: | Testing instructions can be found on the design documents in the SSSD wiki mentioned above. In the following a short summary for each feature can be found: | ||
* Site support: instead of using a random DC form the AD domain, SSSD should only connect to DCs from the local site. This can be checked with the netstat or ss utilities. | * Site support: instead of using a random DC form the AD domain, SSSD should only connect to DCs from the local site. This can be checked with the netstat or ss utilities. | ||
* DNS updates: when the client address is changed, either manually or after DHCP assignment is changed, the client should automatically update its DNS record in the AD. | |||
* Trusted domains: users and groups from the local forest and trusted forests should be available | * Trusted domains: users and groups from the local forest and trusted forests should be available | ||
* | * NetBIOS name discovery: it should be possible to request users using the NetBIOS domain name without specifying it manually in the config file. | ||
* SID-to-Name interface: apart from testing the library itself or its Python bindings, this feature would be prominently visible using the FreeIPA server UI, where Windows users and groups could be identified with their real names (as opposed to SIDs) | |||
There will be a [https://fedoraproject.org/wiki/QA/Fedora_19_test_days Fedora Test day] for this feature at 2013-05-09. | |||
== User Experience == | == User Experience == | ||
| Line 92: | Line 100: | ||
[[Category: | [[Category:FeatureAcceptedF19]] | ||
<!-- When your feature page is completed and ready for review --> | <!-- When your feature page is completed and ready for review --> | ||
<!-- remove Category:FeaturePageIncomplete and change it to Category:FeatureReadyForWrangler --> | <!-- remove Category:FeaturePageIncomplete and change it to Category:FeatureReadyForWrangler --> | ||
<!-- After review, the feature wrangler will move your page to Category:FeatureReadyForFesco... if it still needs more work it will move back to Category:FeaturePageIncomplete--> | <!-- After review, the feature wrangler will move your page to Category:FeatureReadyForFesco... if it still needs more work it will move back to Category:FeaturePageIncomplete--> | ||
<!-- A pretty picture of the page category usage is at: https://fedoraproject.org/wiki/Features/Policy/Process --> | <!-- A pretty picture of the page category usage is at: https://fedoraproject.org/wiki/Features/Policy/Process --> | ||
Latest revision as of 20:53, 15 May 2013
SSSD improve AD integration
Summary
The next major release of SSSD will include support for more advanced AD features for domain members. This includes support for site discovery, dynamic DNS updates, translating SIDs to names and dynamic discovery of the NetBIOS name of an AD domain.
Owner
- Name: Jakub Hrozek
- Email: <jhrozek@redhat.com>
- Name: Sumit Bose
- Email: <sbose@redhat.com>
Current status
- Targeted release: Fedora 19
- Last updated: 2013-05-14
- Percentage of completion: 100%
- Subtasks finished in the Beta:
- DNS site discovery
- DNS dynamic updates
- Dynamic discovery of NetBIOS domain name
- An interface to translate SID to names or IDs and vice versa
Detailed Description
So far SSSD development of AD provider concentrated on doing the user and group lookups for the joined domain efficiently with high performance. With the next major release of SSSD support for some features which are specific to AD domain will be added. This includes:
- Site support: AD domains which include different physical locations can be split into sites. Each site represents a single physical location. With specially crafted DNS service record lookups an AD client can find the nearest domain controller, i.e. the domain controller in its site. This helps to keep network traffic local and allows clients to talk to the server with the lowest latency.
- DNS updates: AD clients will be able to update their DNS record dynamically if assigned a different IP address
- NetBIOS name discovery: at present, the NetBIOS name must be specified as the SSSD domain name in order to make it possible to look up users using the NetBIOS name. In F-19 the SSSD will enable to discover the NetBIOS name dynamically, allowing the lookups to just work.
- An interface to translate SID identifiers to user or group names or POSIX ID. Such interface will be the basis of future CIFS integration as well as used directly by FreeIPA to provide a human-reasable representation of users and groups.
Benefit to Fedora
With the improvements mentioned above a Fedora client which is joined to an AD domain and running SSSD has access to more advance features of the AD domain which were currently only available if winbind was used instead of SSSD.
Scope
All planned features for the next major release of SSSD can be found at [1]. The improvements mentioned above are tracked by the following tickets:
Links to design documents can be found in the tickets.
How To Test
Testing instructions can be found on the design documents in the SSSD wiki mentioned above. In the following a short summary for each feature can be found:
- Site support: instead of using a random DC form the AD domain, SSSD should only connect to DCs from the local site. This can be checked with the netstat or ss utilities.
- DNS updates: when the client address is changed, either manually or after DHCP assignment is changed, the client should automatically update its DNS record in the AD.
- Trusted domains: users and groups from the local forest and trusted forests should be available
- NetBIOS name discovery: it should be possible to request users using the NetBIOS domain name without specifying it manually in the config file.
- SID-to-Name interface: apart from testing the library itself or its Python bindings, this feature would be prominently visible using the FreeIPA server UI, where Windows users and groups could be identified with their real names (as opposed to SIDs)
There will be a Fedora Test day for this feature at 2013-05-09.
User Experience
The user might benefit from reduced latency while accessing the DC (site support) and the ability to use users and groups from trusted domains. Advanced features of the cifs-utils package, e.g. changing ACLs, do not require a running winbindd anymore but can be used with sssd as well.
Dependencies
No additional dependencies are expected. The required version if cifs-utils is already available in Fedora. To parse some blobs returned by AD some libraries from the samba-libs package are needed, but SSSD already depends on other samba libraries.
Contingency Plan
Not required, if some of the improvements are not available in time, they will be moved to the next release.
Documentation
For details see the design documents mentioned above.
Release Notes
With the latest major release to SSSD the integration into AD domain was improved. AD sites are respected and SSSD tries to access the nearest domain controller. users and groups from trusted domains are available. SSSD offers an ID mapping plugin for the cifs-utils which allows to use advanced features of cifs-utils with SSSD.