freeipa

#6882 [RFE] Add granularity to ipa-compat-manage
Opened by pvoborni. Modified

Open
Close Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1440964

Description of problem:
When using the IPA compatibility plugin there are well documented performance
penalties.
This request is add granularity to ipa-compat-manage so that an administrator
can enable/disable specific part(s) of compat. For instance an administrator
may want to enable only sudoers.
Version-Release number of selected component (if applicable):
ipa-server-4.4.0-14.el7_3.4
How reproducible:
ipa-compat-manage currently supports only enable|disable
Additional info:
Provide enable/disable for specific part(s) of ipa-compat-manage

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1440964

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1440964

It should be implemented as API command so that it can be managed the same way also from containers(i.e. avoid docker exec, use API for all reconfigurations)

No, that's not possible.

Schema compat configuration is in cn=config and writable access rights are given only to cn=Directory Manager. We literally cannot run modifications to cn=config as any IPA users unless we assign special ACIs to a set of entries in cn=config. So far nothing in 389-ds was relying on that.

If quick solution is needed that the config might be done with current tools. But there are multiple CLI tools suffering from the same limitation.

I believe this is another case for the so called "configuration daemon": #5974
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.