From gww@sac.sfbay.sun.com Thu Aug 9 17:34:22 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l7A0YLtS004696 for ; Thu, 9 Aug 2007 17:34:22 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l7A0Vpx3019313; Fri, 10 Aug 2007 08:31:59 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JMJ00I0785ACD00@nwk-avmta-2.sfbay.sun.com>; Thu, 09 Aug 2007 17:31:58 -0700 (PDT) Received: from sfbaymail2sca.sfbay.sun.com ([129.145.155.42]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JMJ009Y985AXU50@nwk-avmta-2.sfbay.sun.com>; Thu, 09 Aug 2007 17:31:58 -0700 (PDT) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by sfbaymail2sca.sfbay.sun.com (8.13.6+Sun/8.12.10/ENSMAIL,v2.2) with ESMTP id l7A0Vusb018304; Thu, 09 Aug 2007 17:31:56 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l7A0YHIp004691; Thu, 09 Aug 2007 17:34:17 -0700 (PDT) Received: (from gww@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id l7A0YHoI004687; Thu, 09 Aug 2007 17:34:17 -0700 (PDT) Date: Thu, 09 Aug 2007 17:34:17 -0700 (PDT) From: Gary Winiger Subject: Winchester idmap(1M) update [PSARC/2007/457 FastTrack timeout 08/20/2007] To: PSARC-ext@sun.com Cc: David.Maxera@sun.com, winchester@sun.com Message-id: <200708100034.l7A0YHoI004687@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 3388 Template Version: @(#)sac_nextcase 1.64 07/13/07 SMI This information is Copyright 2007 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: Winchester idmap(1M) update 1.2. Name of Document Author/Supplier: Author: Dave Maxera 1.3 Date of This Document: 09 August, 2007 4. Technical Description I'm sponsoring this case for Dave Maxera and the Winchester project team. It updates the idmap(1M) commend introduced in PSARC/2006/315 "Winchester: Schema Mapping and ID Mapping for AD Interoperability" The project has not yet delivered into Solaris. The release binding remains unchanged as Patch. Likewise, the interfact taxonomy remains unchanged as Uncommitted. During implementation the project team found a number of ambiguities and inconsistencies that this update corrects. An updated man page is in the case directory along with a diff file of the old man page against the updated man page. The timer is set for 20 Aug, 2007 as I'll be on holiday till then. Gary.. +++++++++++++++++++++++++++++++++ Background: =========== idmap(1M) is the management interface for mapping Windows identities to native Solaris (POSIX) identities. It allows the administrator to specify mappings between various Windows and Solaris user and group identities. Problem: ======== In the present Winchester scheme, the type of user (Windows or UNIX) and the form (string or integer) are determined by a prefix to the argument, which are "uid", "gid", "sid", "unixname", and "winname". For example, "uid:1234" represents a user ID with a value of 1234, "unixname:foo" represents a UNIX name (either user or group) foo, and "sid:S-1-2-3" represents a Windows Security IDentifier with a value of S-1-2-3. Displaying what a particular mapping represents such as "idmap show unixname:foo" is ambiguous. foo could be either a user or group. The identity type prefix is optional when it can be determined from context. Unfortunately that leads to the possibility for ambiguities and inconsistencies in use. -u and -g subcommand options are used to imply the type prefix in some commands but not others. In both Unix and Windows names and sids can represent either a group or a user. The proposals in this case are intended to satisfy a potential future consideration. Windows files sometimes have a "group" as the file owner. Mapping Windows groups to Solaris users is not presently part of Winchester, but may be needed in the future. The proposed changes are intended to be sufficient to allow such mappings in the future. Solution: ========= * disambiguate the unix user/group name "unixname" by explicitly specifying "unixuser" and "unixgroup" in all places where "unixname" was used. * disambiguate the Windows identity names "winname" and "sid" by explicitly specifying "winuser", "wingroup" and "usid", "gsid" as needed. * remove the -u and -g options as they are not needed since the identity types are now disambiguated. This does lead to a functional change in the dump and list subcommands. With this change, to get only users or groups greping for "uid:", "gid:", "user:", "group:", ... is now needed. See identity and example 2 in idmap(1M). 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From gww@eng.sun.com Mon Aug 20 17:26:05 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l7L0Q4NK003913 for ; Mon, 20 Aug 2007 17:26:04 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l7L0NUOq002268; Tue, 21 Aug 2007 01:23:32 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JN300M0NL37VJ00@brm-avmta-1.central.sun.com>; Mon, 20 Aug 2007 18:23:31 -0600 (MDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JN300DG3L365HA0@brm-avmta-1.central.sun.com>; Mon, 20 Aug 2007 18:23:30 -0600 (MDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l7L0NSk4013075; Mon, 20 Aug 2007 17:23:28 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l7L0O9nP009952; Mon, 20 Aug 2007 17:24:09 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l7L0O9ZH009951; Mon, 20 Aug 2007 17:24:09 -0700 (PDT) Date: Mon, 20 Aug 2007 17:24:09 -0700 (PDT) From: Gary Winiger Subject: Re: Winchester idmap(1M) update [PSARC/2007/457 FastTrack timeout 08/20/2007] To: PSARC-ext@sun.com, gww@sac.sfbay.sun.com Cc: David.Maxera@sun.com, winchester@sun.com Message-id: <200708210024.l7L0O9ZH009951@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 226 > The timer is set for 20 Aug, 2007 as I'll be on holiday till then. While the timer has run with no comment, since the PSARC server has been down for a couple days, I'm going to give this till tomorrow afternoon. Gary.. From gww@eng.sun.com Tue Aug 21 17:41:12 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l7M0fCCu019970 for ; Tue, 21 Aug 2007 17:41:12 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l7M0cMrD017164; Wed, 22 Aug 2007 08:38:38 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JN500D01GGCXV00@nwk-avmta-2.sfbay.sun.com>; Tue, 21 Aug 2007 17:38:36 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JN5002LPGGCZYC0@nwk-avmta-2.sfbay.sun.com>; Tue, 21 Aug 2007 17:38:36 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l7M0cYrW028404; Tue, 21 Aug 2007 17:38:34 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l7M0dG80023922; Tue, 21 Aug 2007 17:39:16 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l7M0dG1h023921; Tue, 21 Aug 2007 17:39:16 -0700 (PDT) Date: Tue, 21 Aug 2007 17:39:16 -0700 (PDT) From: Gary Winiger Subject: Re: Winchester idmap(1M) update [PSARC/2007/457 FastTrack timeout 08/20/2007] To: PSARC-ext@Sun.Com, gww@eng.sun.com, gww@sac.sfbay.sun.com Cc: David.Maxera@Sun.Com, winchester@Sun.Com Message-id: <200708220039.l7M0dG1h023921@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 273 > > The timer is set for 20 Aug, 2007 as I'll be on holiday till then. > > While the timer has run with no comment, since the PSARC server > has been down for a couple days, I'm going to give this till > tomorrow afternoon. It's time. This case is approved. Gary..