View source for Release Meeting Minutes/2013-02-19

{{minutes|2013}}
David Benjamin, Shawn Emery, Will Fiveash, Greg Hudson, Ben Kaduk, Simo Sorce, Zhanna Tsitkov, Tom Yu

;Greg: Dmitri Pal is advocating for generic printf-like thing as opposed to one function per event. Dmitri wants plugin to handle future events without updating module.

;Simo: Because we send somewhat linearized, we wouldn't have to linearize in the plugin.

;Greg: Could provide both.

;Shawn: Current structure of audit is separate function wrappers. Populate event structure into audit system. XML. Dynamic generation. Revamp in progress includes libbsm, XML definitions, primitives.

;Tom: Enumerated event types in libbsm will be preserved?

;Shawn: Broken down to KDC, kadmin. XML ID # per service event (KDC/kadmin). More transparent info. (Yes, retain one numeric ID per event type.)

;Greg: XML affects API?

;Shawn: Superset of structure.

;Greg: several possibilities
:# 1 function per event... plugin writer linearizes
:# call 1 generic function
:# hybrid: default implementation of function linearizes (if back end doesn't implement a specific event function)

;Shawn: To support more generic approach, operator as element of event structure... string.

;Greg: Can't find...

;Shawn: Framework. ADT interface. Will try to find differences.

;Tom: Would like to hear high level requirements about what events need to be audited.

==domain_realm==

;Simo: Multiple masters. Trust relationships. Which KDC to contact. Trusted domains. CAnnot change domain_realm mappings on the fly. Pluggable interfaces?

;Greg: Not too hard. (Right now busy with an2lname though) You can do via your custom KDB back end.

;Simo: Dropping domain_realm into include file but not getting read until KDC restart.

;Greg: Tough the master profile file.

;Tom: We've talked about removing rechecking behavior in the future, so don't count on this as a long-term solution.

;Simo: New trust with AD.

;Greg: DAL can return a referral TGS principal.

;Simo: Clients using domain_realm. So need plugin.

Greg recaps long-term DNS avoidance strategy.

;Greg: Plugin work more likely to happen in 1.12 time frame. Short hostnames... does client append domain? Sending short names to KDC... Nico et al. say the KDC's search path might be different than the client's; need to deal somehow. Maybe get search path through res_* API.

;Simo: First send user-provided name without change, then maybe append domain.

;Tom: Your preference is to have config variable to turn off client hostname resolution? (This could happen for 1.12.)

;Simo: Yes.