Features/SSSDImproveADIntegration

From FedoraProject

< Features(Difference between revisions)
Jump to: navigation, search
(Moved to FeatureReadyForFesco for approval (#1020))
(Feature accepted on Jan 30 FESCo meeting (#1020))
Line 90: Line 90:
  
  
[[Category:FeatureReadyForFesco]]
+
[[Category:FeatureAcceptedF19]]
 
<!-- When your feature page is completed and ready for review -->
 
<!-- When your feature page is completed and ready for review -->
 
<!-- remove Category:FeaturePageIncomplete and change it to Category:FeatureReadyForWrangler -->
 
<!-- remove Category:FeaturePageIncomplete and change it to Category:FeatureReadyForWrangler -->
 
<!-- After review, the feature wrangler will move your page to Category:FeatureReadyForFesco... if it still needs more work it will move back to Category:FeaturePageIncomplete-->
 
<!-- After review, the feature wrangler will move your page to Category:FeatureReadyForFesco... if it still needs more work it will move back to Category:FeaturePageIncomplete-->
 
<!-- A pretty picture of the page category usage is at: https://fedoraproject.org/wiki/Features/Policy/Process -->
 
<!-- A pretty picture of the page category usage is at: https://fedoraproject.org/wiki/Features/Policy/Process -->

Revision as of 18:31, 30 January 2013


Contents

Feature Name

SSSD improve AD integration

Summary

The next major release of SSSD will include support for more advanced AD features for domain members. This includes site support and trusted domains. Additionally it will include a plugin for the cifs-utils package which would allow a CIFS client to use SSSD for lookups which were currently only possible with winbind.

Owner

Current status

  • Targeted release: Fedora 19
  • Last updated: 2013-01-23
  • Percentage of completion: 30%

Detailed Description

So far SSSD development of AD provider concentrated on doing the user and group lookups for the joined domain efficiently with high performance. With the next major release of SSSD support for some features which are specific to AD domain will be added. This includes:

  • Site support: AD domains which include different physical locations can be split into sites. Each site represents a single physical location. With specially crafted DNS service record lookups an AD client can find the nearest domain controller, i.e. the domain controller in its site. This helps to keep network traffic local and allows clients to talk to the server with the lowest latency.
  • Trusted domains: currently the SSSD AD provider can only look up user and groups of the joined domain. With the support of Global Catalogs all users and groups of the forest the AD domain belongs to are available. Additionally it is planned to follow cross forest trust to look up users and groups in trusted forests.
  • CIFS client integration: in version 5.9 of the cifs-utils a plugin interface for ID mapping was added. This allows cifs-utils to use other services than winbind for those lookups. While those lookups are not needed for basic operation, i.e. accessing files from a Linux client on a Windows/Samba file server, they are needed e.g. when accessing and modifying access control lists (ACLs).

Benefit to Fedora

With the improvements mentioned above a Fedora client which is joined to an AD domain and running SSSD has access to more advance features of the AD domain which were currently only available if winbind was used instead of SSSD.

Scope

All planned features for the next major release of SSSD can be found at [1]. The improvements mentioned above are tracked by the following tickets:

Links to design documents can be found in the tickets.

How To Test

Testing instructions can be found on the design documents in the SSSD wiki mentioned above. In the following a short summary for each feature can be found:

  • Site support: instead of using a random DC form the AD domain, SSSD should only connect to DCs from the local site. This can be checked with the netstat or ss utilities.
  • Trusted domains: users and groups from the local forest and trusted forests should be available
  • CIFS client integration: all tools from the cifs-utils package work as expected without a running winbindd on the client

User Experience

The user might benefit from reduced latency while accessing the DC (site support) and the ability to use users and groups from trusted domains. Advanced features of the cifs-utils package, e.g. changing ACLs, do not require a running winbindd anymore but can be used with sssd as well.

Dependencies

No additional dependencies are expected. The required version if cifs-utils is already available in Fedora. To parse some blobs returned by AD some libraries from the samba-libs package are needed, but SSSD already depends on other samba libraries.

Contingency Plan

Not required, if some of the improvements are not available in time, they will be moved to the next release.

Documentation

For details see the design documents mentioned above.

Release Notes

With the latest major release to SSSD the integration into AD domain was improved. AD sites are respected and SSSD tries to access the nearest domain controller. users and groups from trusted domains are available. SSSD offers an ID mapping plugin for the cifs-utils which allows to use advanced features of cifs-utils with SSSD.

Comments and Discussion