From nw141292@sac.sfbay.sun.com Mon Mar 3 13:02:02 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m23L223S013317 for ; Mon, 3 Mar 2008 13:02:02 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m23L21m5046476; Mon, 3 Mar 2008 14:02:02 -0700 (MST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JX600H19AFDUU00@brm-avmta-1.central.sun.com>; Mon, 03 Mar 2008 14:02:01 -0700 (MST) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JX6005VQAFDOOC0@brm-avmta-1.central.sun.com>; Mon, 03 Mar 2008 14:02:01 -0700 (MST) Received: from sac.sfbay.sun.com (new-sac.SFBay.Sun.COM [129.146.175.65]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m23L20Ou000119; Mon, 03 Mar 2008 13:02:00 -0800 (PST) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m23KsT3V013172; Mon, 03 Mar 2008 12:54:29 -0800 (PST) Received: (from nw141292@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id m23KsTov013168; Mon, 03 Mar 2008 12:54:29 -0800 (PST) Date: Mon, 03 Mar 2008 12:54:29 -0800 (PST) From: Nicolas Williams Subject: idmap(1M) observability [PSARC/2008/167 FastTrack timeout 03/12/2008] To: PSARC-ext@sun.com Cc: sparks-discuss@sun.com, storage-discuss@sun.com Message-id: <200803032054.m23KsTov013168@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 3987 Template Version: @(#)sac_nextcase 1.64 07/13/07 SMI This information is Copyright 2008 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: idmap(1M) observability 1.2. Name of Document Author/Supplier: Author: Nicolas Williams 1.3 Date of This Document: 03 March, 2008 4. Technical Description I'm sponsoring this case for Julian Pullen. I've set the timer to expire on Wednesday, March 12th, 2008. The requested release binding is micro/patch (note: the base ARC case has minor release binding, so "micro/patch" here is not meaningfully different from minor). BACKGROUND ---------- PSARC/2006/315 introduced a facility for mapping between Windows and Solaris user/group identities. idmap(1M) is the primary user interface for the Solaris ID mapping facility. It allows the administrator to specify rules for ID mapping, as well as to observe what identities have been mapped, and to request mappings for specific IDs. idmap now supports the following mapping methods 1) Hardcoded mappings for _some_ Well-Known SIDs 2) Directory-based name mapping using AD only (soon also using native LDAP, and a mixed mode; see PSARC/2007/663) 3) Name-based rule mapping 4) Ephemeral mapping 5) Local SID mapping PROBLEM ------- The idmap(1M) utility provides no information as to how any one mapping was performed, nor what conditions led to failure to produce a requested mapping. SOLUTION -------- This case enhances idmap to enable it to display how the the identifiers were mapped. The "idmap show" and "idmap dump" commands will be extended with a -v flag to display this information. The "idmap show" command will also display whether the ID mapping was just generated as a result of the command or whether it had been cached. The information displayed will include the type of mapping. For directory-based name mapping it will include if the Directory is AD or Native LDAP, the Distinguished name of the entry and the mapping attribute and value. For name-based rule mapping it will include the matching rule. Man page diffs will be added to the case directory. INTERFACE STABILITY ------------------- The new -v option to 'idmap dump' and 'idmap show' will be Committed. The output of 'idmap dump' and 'idmap show' is hereby declared to be Not an Interface. A future case may introduce stable output formats suitable for scripting. PHASED DELIVERY --------------- We may deliver this case in two phases: one that adds observability for success cases, and one that adds observability for failure cases. We expect this provision to be non-controversial given the Not-an- Interface nature of idmap(1M)'s output at this time. OUTPUT ------ [Remember, idmap(1M) output remains Not an Interface, thus we reserve the right to change the output formats shown below.] Success cases: % idmap show ... % idmap show -v ... New: yes | cached Method: [DN: ] [Attribute: = ] [Rule: ] Where: - is the output that idmap produces today. - is one of: AD Directory, Native LDAP Directory, Name Rule, Ephemeral, Local SID, Well-Known mapping. - is the DN of an AD or native LDAP object (if ds-based name mapping was used). - and are the name and value of the attribute used for directory-based name mapping (if ds-based name mapping was used). - is the matching name-based rule, if any, using the same format as used by "idmap list" today. Output for "idmap dump" will be the same as "show -v" but it will not contain "New: ..." (all dumped entries must be in the cache). Error cases: % idmap show ... [] Failed Method: Error: 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From Nicolas.Williams@sun.com Mon Mar 3 13:05:27 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m23L5QBC013351 for ; Mon, 3 Mar 2008 13:05:27 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m23L5HSB020314 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 4 Mar 2008 05:05:25 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JX600C0FAKZGQ00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 03 Mar 2008 13:05:23 -0800 (PST) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JX6000KKAKZ0U80@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 03 Mar 2008 13:05:23 -0800 (PST) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m23L5MUf002919; Mon, 03 Mar 2008 15:05:22 -0600 (CST) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m23L5MMh002918; Mon, 03 Mar 2008 15:05:22 -0600 (CST) Date: Mon, 03 Mar 2008 15:05:22 -0600 From: Nicolas Williams Subject: Re: idmap(1M) observability [PSARC/2008/167 FastTrack timeout 03/12/2008] In-reply-to: <200803032054.m23KsTov013168@sac.sfbay.sun.com> To: Nicolas Williams Cc: PSARC-ext@sun.com, sparks-discuss@opensolaris.org, storage-discuss@opensolaris.org Mail-followup-to: Nicolas Williams , PSARC-ext@sun.com, sparks-discuss@opensolaris.org, storage-discuss@opensolaris.org Message-id: <20080303210521.GI986@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <200803032054.m23KsTov013168@sac.sfbay.sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 4518 I typoed the OpenSolaris discuss list names. Sigh. Please cc' sparks-discuss@opensolaris.org and storage-discuss@opensolaris.org, not sparks-discuss@sun.com and storage-discuss@sun.com. Nico On Mon, Mar 03, 2008 at 12:54:29PM -0800, Nicolas Williams wrote: > > Template Version: @(#)sac_nextcase 1.64 07/13/07 SMI > This information is Copyright 2008 Sun Microsystems > 1. Introduction > 1.1. Project/Component Working Name: > idmap(1M) observability > 1.2. Name of Document Author/Supplier: > Author: Nicolas Williams > 1.3 Date of This Document: > 03 March, 2008 > 4. Technical Description > > I'm sponsoring this case for Julian Pullen. I've set the timer to > expire on Wednesday, March 12th, 2008. > > The requested release binding is micro/patch (note: the base ARC case > has minor release binding, so "micro/patch" here is not meaningfully > different from minor). > > BACKGROUND > ---------- > > PSARC/2006/315 introduced a facility for mapping between Windows and > Solaris user/group identities. > > idmap(1M) is the primary user interface for the Solaris ID mapping > facility. It allows the administrator to specify rules for ID mapping, > as well as to observe what identities have been mapped, and to request > mappings for specific IDs. > > idmap now supports the following mapping methods > 1) Hardcoded mappings for _some_ Well-Known SIDs > 2) Directory-based name mapping using AD only (soon also using > native LDAP, and a mixed mode; see PSARC/2007/663) > 3) Name-based rule mapping > 4) Ephemeral mapping > 5) Local SID mapping > > PROBLEM > ------- > > The idmap(1M) utility provides no information as to how any one mapping > was performed, nor what conditions led to failure to produce a requested > mapping. > > SOLUTION > -------- > > This case enhances idmap to enable it to display how the the identifiers > were mapped. The "idmap show" and "idmap dump" commands will be > extended with a -v flag to display this information. The "idmap show" > command will also display whether the ID mapping was just generated as a > result of the command or whether it had been cached. > > The information displayed will include the type of mapping. For > directory-based name mapping it will include if the Directory is AD or > Native LDAP, the Distinguished name of the entry and the mapping > attribute and value. For name-based rule mapping it will include the > matching rule. > > Man page diffs will be added to the case directory. > > INTERFACE STABILITY > ------------------- > > The new -v option to 'idmap dump' and 'idmap show' will be Committed. > > The output of 'idmap dump' and 'idmap show' is hereby declared to be Not > an Interface. A future case may introduce stable output formats > suitable for scripting. > > PHASED DELIVERY > --------------- > > We may deliver this case in two phases: one that adds observability for > success cases, and one that adds observability for failure cases. > > We expect this provision to be non-controversial given the Not-an- > Interface nature of idmap(1M)'s output at this time. > > OUTPUT > ------ > > [Remember, idmap(1M) output remains Not an Interface, thus we reserve > the right to change the output formats shown below.] > > Success cases: > > % idmap show ... > > % idmap show -v ... > > New: yes | cached > Method: > [DN: ] > [Attribute: = ] > [Rule: ] > > Where: > > - is the output that idmap produces today. > > - is one of: AD Directory, Native LDAP Directory, Name > Rule, Ephemeral, Local SID, Well-Known mapping. > > - is the DN of an AD or native LDAP object (if ds-based name > mapping was used). > > - and are the name and value of the > attribute used for directory-based name mapping (if ds-based name > mapping was used). > > - is the matching name-based rule, if any, using the same format > as used by "idmap list" today. > > Output for "idmap dump" will be the same as "show -v" but it will not > contain "New: ..." (all dumped entries must be in the cache). > > > Error cases: > > % idmap show ... > [] > Failed Method: > Error: > > > > 6. Resources and Schedule > 6.4. Steering Committee requested information > 6.4.1. Consolidation C-team Name: > ON > 6.5. ARC review type: FastTrack > 6.6. ARC Exposure: open > From Nicolas.Williams@sun.com Wed Mar 5 10:16:53 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m25IGqUF010625 for ; Wed, 5 Mar 2008 10:16:53 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m25IGo5u056931 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 5 Mar 2008 11:16:52 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JX900525S42Z900@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 05 Mar 2008 10:16:50 -0800 (PST) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JX9005UJS422320@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 05 Mar 2008 10:16:50 -0800 (PST) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m25IGnjH003826; Wed, 05 Mar 2008 12:16:49 -0600 (CST) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m25IGmHQ003825; Wed, 05 Mar 2008 12:16:48 -0600 (CST) Date: Wed, 05 Mar 2008 12:16:48 -0600 From: Nicolas Williams Subject: Re: idmap(1M) observability [PSARC/2008/167 FastTrack timeout 03/12/2008] In-reply-to: <20080303210521.GI986@Sun.COM> To: Nicolas Williams , PSARC-ext@sun.com, sparks-discuss@opensolaris.org, storage-discuss@opensolaris.org Mail-followup-to: Nicolas Williams , PSARC-ext@sun.com, sparks-discuss@opensolaris.org, storage-discuss@opensolaris.org Message-id: <20080305181647.GT986@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <200803032054.m23KsTov013168@sac.sfbay.sun.com> <20080303210521.GI986@Sun.COM> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 4948 This case was approved at today's PSARC meeting. I've updated the IAM file. On Mon, Mar 03, 2008 at 03:05:22PM -0600, Nicolas Williams wrote: > I typoed the OpenSolaris discuss list names. Sigh. > > Please cc' sparks-discuss@opensolaris.org and storage-discuss@opensolaris.org, > not sparks-discuss@sun.com and storage-discuss@sun.com. > > Nico > > On Mon, Mar 03, 2008 at 12:54:29PM -0800, Nicolas Williams wrote: > > > > Template Version: @(#)sac_nextcase 1.64 07/13/07 SMI > > This information is Copyright 2008 Sun Microsystems > > 1. Introduction > > 1.1. Project/Component Working Name: > > idmap(1M) observability > > 1.2. Name of Document Author/Supplier: > > Author: Nicolas Williams > > 1.3 Date of This Document: > > 03 March, 2008 > > 4. Technical Description > > > > I'm sponsoring this case for Julian Pullen. I've set the timer to > > expire on Wednesday, March 12th, 2008. > > > > The requested release binding is micro/patch (note: the base ARC case > > has minor release binding, so "micro/patch" here is not meaningfully > > different from minor). > > > > BACKGROUND > > ---------- > > > > PSARC/2006/315 introduced a facility for mapping between Windows and > > Solaris user/group identities. > > > > idmap(1M) is the primary user interface for the Solaris ID mapping > > facility. It allows the administrator to specify rules for ID mapping, > > as well as to observe what identities have been mapped, and to request > > mappings for specific IDs. > > > > idmap now supports the following mapping methods > > 1) Hardcoded mappings for _some_ Well-Known SIDs > > 2) Directory-based name mapping using AD only (soon also using > > native LDAP, and a mixed mode; see PSARC/2007/663) > > 3) Name-based rule mapping > > 4) Ephemeral mapping > > 5) Local SID mapping > > > > PROBLEM > > ------- > > > > The idmap(1M) utility provides no information as to how any one mapping > > was performed, nor what conditions led to failure to produce a requested > > mapping. > > > > SOLUTION > > -------- > > > > This case enhances idmap to enable it to display how the the identifiers > > were mapped. The "idmap show" and "idmap dump" commands will be > > extended with a -v flag to display this information. The "idmap show" > > command will also display whether the ID mapping was just generated as a > > result of the command or whether it had been cached. > > > > The information displayed will include the type of mapping. For > > directory-based name mapping it will include if the Directory is AD or > > Native LDAP, the Distinguished name of the entry and the mapping > > attribute and value. For name-based rule mapping it will include the > > matching rule. > > > > Man page diffs will be added to the case directory. > > > > INTERFACE STABILITY > > ------------------- > > > > The new -v option to 'idmap dump' and 'idmap show' will be Committed. > > > > The output of 'idmap dump' and 'idmap show' is hereby declared to be Not > > an Interface. A future case may introduce stable output formats > > suitable for scripting. > > > > PHASED DELIVERY > > --------------- > > > > We may deliver this case in two phases: one that adds observability for > > success cases, and one that adds observability for failure cases. > > > > We expect this provision to be non-controversial given the Not-an- > > Interface nature of idmap(1M)'s output at this time. > > > > OUTPUT > > ------ > > > > [Remember, idmap(1M) output remains Not an Interface, thus we reserve > > the right to change the output formats shown below.] > > > > Success cases: > > > > % idmap show ... > > > > % idmap show -v ... > > > > New: yes | cached > > Method: > > [DN: ] > > [Attribute: = ] > > [Rule: ] > > > > Where: > > > > - is the output that idmap produces today. > > > > - is one of: AD Directory, Native LDAP Directory, Name > > Rule, Ephemeral, Local SID, Well-Known mapping. > > > > - is the DN of an AD or native LDAP object (if ds-based name > > mapping was used). > > > > - and are the name and value of the > > attribute used for directory-based name mapping (if ds-based name > > mapping was used). > > > > - is the matching name-based rule, if any, using the same format > > as used by "idmap list" today. > > > > Output for "idmap dump" will be the same as "show -v" but it will not > > contain "New: ..." (all dumped entries must be in the cache). > > > > > > Error cases: > > > > % idmap show ... > > [] > > Failed Method: > > Error: > > > > > > > > 6. Resources and Schedule > > 6.4. Steering Committee requested information > > 6.4.1. Consolidation C-team Name: > > ON > > 6.5. ARC review type: FastTrack > > 6.6. ARC Exposure: open > >