Original IFP integration was done via ticket https://pagure.io/freeipa/issue/6225

I'd rather not add a code snippet to /etc/sssd/conf.d but update sssd.conf. Allowed uids don't add up. SSSD's config loader is implemented as winner takes it all. If multiple config files define an option, then the last config file overrides all other settings.

Ok, whatever works. The snippet approach was suggested by @jhrozek originally.

Yes, I just thought that dropping a snippet is easier for the IPA installer. But I agree that modifying the main config file is safer from the point of view of modifying the file later.

Related to the issue: The installer code contains some extra checks to deal with unrecognized services

def sssd_enable_service(sssdconfig, service):
    try:
        sssdconfig.new_service(service)
    except SSSDConfig.ServiceAlreadyExists:
        pass
    except SSSDConfig.ServiceNotRecognizedError:
        logger.error(
            "Unable to activate the %s service in SSSD config.", service)
        logger.info(
            "Please make sure you have SSSD built with %s support "
            "installed.", service)
        logger.info(
            "Configure %s support manually in /etc/sssd/sssd.conf.", service)
    sssdconfig.activate_service(service)

However the check has a bug and fails to handle unrecognized services:

>>> from SSSDConfig import SSSDConfig
>>> from ipaclient.install.client import sssd_enable_service
>>> sssdconfig = SSSDConfig()
>>> sssdconfig.import_config()
>>> sssd_enable_service(sssdconfig, 'unsupported')
Unable to activate the unsupported service in SSSD config.
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.7/site-packages/ipaclient/install/client.py", line 1035, in sssd_enable_service
    sssdconfig.activate_service(service)
  File "/usr/lib/python3.7/site-packages/SSSDConfig/__init__.py", line 1693, in activate_service
    raise NoServiceError
SSSDConfig.NoServiceError

The server upgrade code has a more severe bug. It uses SSSDConfig to enable the ifp service, however it never writes the modified config to disk.

The ifp service shouldn't be required to be enabled automatically. It's a D-Bus service and D-Bus should be capable of activating it on its own.

On the other hand, if it's required often on the server, then there's little harm in making sure it's on all the time and might actually be safer and more performance (no startup delays, no races on idle timeout..)

master:

• 8b0f3595fd94a31a0e2d5a83dc74a430c973325b Allow ipaapi user to access SSSD's info pipe

ipa-4-7:

• 785c496dceb76a8f628249ce598e0540b1dfec6e Allow ipaapi user to access SSSD's info pipe

ipa-4-6:

• 43bb1d2091e062ca5affd445e1427a7a87b24dfd Allow ipaapi user to access SSSD's info pipe

master:

• 8a835daf478195e00ed04c206c24c09afdfd927f certupdate: add commentary about certmonger behaviour

ipa-4-7:

• 683af82db848e457ec6855b4ea099a1b4ede66d8 certupdate: add commentary about certmonger behaviour

ipa-4-6:

• 35e9f64767c30d33e218d01ca4597e46a6fad656 certupdate: add commentary about certmonger behaviour

master:

• d6fd2ad4f2f0a95740bf73819260f49b216e6b78 Remove dead code
• 917d81b83259ef8f4f21fda7dfeb4d32eac61f5f Allow HTTPd user to access SSSD IFP
• 0a2222ea26386edd7c4472d4da073fcec0375203 Smart card auth advise: Allow Apache user
• a86abd37e96d56e9be8d551042b449a8ba058da8 Log stderr in run_command
• f0e11dac2d0164d6fdd6947deb6d45a09b03b10d Test smart card advise scripts
• f330c59dd8946b649c0d44c17d86bce2b836e993 Add install/remove package helpers to advise

ipa-4-7:

• eb0136ea3438b6fb1145456478f401b9b7467cba Remove dead code
• 415295a6f68f4c797529e19a3f0cf956619d4bed Allow HTTPd user to access SSSD IFP
• d7d17ece57ae1322c8368b7853f24d56b1d6a150 Smart card auth advise: Allow Apache user
• b56db8daa704782c44683412b85a454654eabc19 Log stderr in run_command
• 97776d2c4eed5de73780476bb11a635a2e47ebc5 Test smart card advise scripts
• 6ed90a2ac08c070e8e5c47a1eb3c52d7d30cabb8 Add install/remove package helpers to advise
• e05ce4a20d2395179580db7e3db75c601c8f364c Python 2 compatibility

master:

• caffe2e8dd14a9fa8887db72bfbfbab11f5e5c0e Fix test_advise in nightly runs