<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>
<style type="text/css">p { margin-bottom: 0.25cm; line-height: 120%; }a:link { }</style>
</p>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt>Hi
All,</tt></font></p>
<font size="+1"><tt></tt></font>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt>Regarding
Git hub issue :
</tt><tt><a
href="https://github.com/openbmc/openbmc/issues/3305">https://github.com/openbmc/openbmc/issues/3305</a></tt></font></p>
<font size="+1"><tt>
</tt></font>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt>Per
my analysis
following are the desired/mandatory parameters which needs to
be
configured -</tt></font></p>
<font size="+1"><tt>
</tt></font>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt>1)
Global for all
LDAP servers</tt></font></p>
<font size="+1"><tt>
</tt></font>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt>
LDAP
certificate configuration(</tt><tt><i>assuming same
certificate can be used
for all the LDAP servers in the case of secure ldap</i></tt><tt>).</tt></font></p>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt>Certificate
configuration would be done with separate activity. <br>
</tt></font></p>
<font size="+1"><tt><br>
</tt></font>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt>2)
Specific to each
LDAP server</tt></font></p>
<font size="+1"><tt>
</tt></font>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt>
a)LDAP server IP</tt></font></p>
<font size="+1"><tt>
</tt></font>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt>
b)Secure v/s Non
secure LDAP</tt><tt><br>
</tt></font></p>
<font size="+1"><tt>
</tt></font>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt>
c)Search Base:
Where the search should start on the ldap server</tt></font></p>
<font size="+1"><tt>
</tt></font>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt>
d)Scope of the
search: One level or search till the end of the tree.</tt></font></p>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt>Users
would be allowed to configure multiple LDAP servers.<br>
</tt></font></p>
<font size="+1"><tt><br>
</tt><tt></tt></font>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt><u><b>Methods
to
configure</b></u></tt></font></p>
<font size="+1"><tt>
</tt></font>
<p style="margin-bottom: 0cm; line-height: 100%"> </p>
<font size="+1"><tt>
</tt></font>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt>Option
1) Define the D-Bus API which takes all these parameters and
updates the
configuration files accordingly. </tt></font></p>
<font size="+1"><tt>
</tt></font>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt><i>Pros:
Not tied to
a specific ldap client(sssd/openLDAP)</i></tt></font></p>
<font size="+1"><tt>
</tt><tt><br>
</tt><tt>
</tt></font>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt>Option
2) Upload the
configuration file directly(</tt><tt><i>sssd.conf </i></tt><tt><i>&</i></tt><tt><i>
ldap.conf</i></tt><tt>)</tt></font></p>
<font size="+1"><tt>
</tt></font>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt><i>Cons:
Additional
overhead of doing file parsing and more bad path validations
than
option 1)</i></tt></font></p>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt><i>In
the option2 don't do any validation and copy the conf file
but expecting user should validate the correctness of the
conf file.<br>
</i></tt></font></p>
<font size="+1"><tt>
</tt></font>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt><i>Need
opinion from
the community members on this proposal on the methods to
configure.</i></tt></font></p>
<p style="margin-bottom: 0cm; line-height: 100%"><font size="+1"><tt><i>Regards</i></tt></font></p>
<p style="margin-bottom: 0cm; line-height: 100%"><i><font size="+1"><tt>Ratan
Gupta</tt></font><br>
</i></p>
</body>
</html>