samba - Sep 2020 - SID mapping: Samba and SSSD

Rpvs> On 04/09/2020 19:02, Gregory Sloop wrote:
>> Re: [Samba] SID mapping: Samba and SSSD
>> *Rpvs> On 03/09/2020 22:35, Jeremy Allison wrote:
>> >> On Thu, Sep 03, 2020 at 10:20:09PM +0100, Rowland penny via
samba
>> wrote:
>> >>> On 03/09/2020 22:08, Jeremy Allison wrote:
>> >>>> Happy to review if you write it :-). Anything that
>> >>>> will remove friction moving to/from winbindd/sssd
>> >>>> would be good for users !
>> >>> And I will be happy to 'NACK' it, we do not need
another idmap
>> backend, well
>> >>> not unless it it is a total rewrite to give us something
like how
>> RID works
>> >>> on Windows and is the only idmap backend.
>> >>> There would be no friction if everyone would accept that
using
>> sssd with
>> >>> Samba is no longer supported by anyone. Red-Hat could make
this
>> more obvious
>> >>> by removing sssd-winbind-idmap, their documentation says
it use isn't
>> >>> supported.
>> >> I'm just trying to make users lives happier :-). Why do
you
>> >> hate happy users Rowland ? :-) :-).
>> Rpvs> I do not hate happy users, I just do not see the point to sssd
with
>> Rpvs> Samba, I actually think they will be happier without sssd
>> *It really seems to me like we ought to let users decide THEMSELVES, 
>> what will make them happy, eh?
>> I'll just leave it there.
Rpvs> HI Gregory, no one is saying that users of Samba cannot use sssd, it is
Rpvs> just that nobody will give you support if you do. If you are using
Samba
 >>= 4.8.0 with sssd on a Unix domain member, then you are on your own if 
Rpvs> you run into problems, unless you are asking for support to move to
winbind.

Rpvs> Rowland

IMHO, that's not actually how you act and respond.
When I saw this latest thread come up on SSSD, I was like; "Oh, no!
Rowland's going to have puppies!", because you get so terribly
exercised about SSSD questions.

If you don't want to field any questions about SSSD, then don't.
If you don't want to offer support on SSSD, then don't.

But, again IMO, you aren't pleasant about any SSSD questions. I'm not
sure why it's such a point of contention.
I mean, look at this response.

From here: https://lists.samba.org/archive/samba/2020-September/231767.html
>> This does make me wonder whether it would be worth adding an optional
>> non-default parameter to idmap_autorid to have it use the sssd slicing
>> algorithm to determine ranges. Sort of like SSSD has an autorid
>> compatibility parameter.
> Happy to review if you write it :-). Anything that
> will remove friction moving to/from winbindd/sssd
> would be good for users !
And I will be happy to 'NACK' it, we do not need another idmap backend, 
well not unless it it is a total rewrite to give us something like how 
RID works on Windows and is the only idmap backend.

There would be no friction if everyone would accept that using sssd with 
Samba is no longer supported by anyone. Red-Hat could make this more 
obvious by removing sssd-winbind-idmap, their documentation says it use 
isn't supported.

That's your response to your own Samba team member, JA.

That's not just simply saying "It's not supported." IMO,
that's being borish. And that's certainly not the only time you were
abrasive in the thread. [Again, these are all my *opinions,* I have no idea if
anyone else agrees or not.]

You do a lot of fielding of questions on Samba, and that's great. It's a
thankless job, and I'm sure it's a grind.
I just think a deep breath occasionally when you're frustrated might be
handy.

-Greg

On 04/09/2020 19:50, Gregory Sloop via samba wrote:
> IMHO, that's not actually how you act and respond.
My problem with sssd being discussed on the Samba mailing list is three 
fold:

It isn't a Samba product.

It isn't supported by anyone (including its producer) when used with 
winbind on Samba >= 4.8.0

You do not need to use it with Samba and never have had to.

How many times do I have say this ?

No wonder I get wound up it, it seems that it comes up very regularly 
and when I point out that it isn't supported, someone always jumps in 
and says 'yes, but it works for me', which it will do if you are using 
the standard Samba packages on something like Ubuntu 18.04

This is the 'samba mailing list' and Samba does not produce sssd, so we 
know very little about it, the correct place to discuss sssd is on the 
aptly named 'sssd-users' mailing list.

There is no need (in my opinion) for yet another idmap backend and I 
can, if I so wish, 'NACK' any new ones. If someone was to write a tool 
to sync data (along with ownership and permissions) from a machine 
running sssd to a machine running winbind, then this would get my approval.

Rowland

On Fri, Sep 04, 2020 at 08:34:29PM +0100, Rowland penny via samba
wrote:
> 
> There is no need (in my opinion) for yet another idmap backend and I can,
if
> I so wish, 'NACK' any new ones. If someone was to write a tool to
sync data
> (along with ownership and permissions) from a machine running sssd to a
> machine running winbind, then this would get my approval.
Sounds like someone needs "The Little Book of Calm" :-).

https://www.youtube.com/watch?v=eCT-PImSMzs

Everything you say is correct, sssd isn't a Samba product
or supported here. I understand it gets irritating continually
referring people off-list.

Maybe just ignore sssd posts ?

NAK'ing something is an extreme measure (IMHO), only used in
irresolvable technical differences. Always better to discuss
the requirements and maybe come to a compromise.

Just my 2cents (that should be 1.5 pennies for you :-) :-).