Editing directory services with Yast2

[rhabacker]

Project Title: Editing directory services with Yast2

Description: For the provision of directory services, the openSUSE distribution has moved from openLDAP to 389-ds. Yast2 supports the creation of directory services (see below), but not further editing, which is currently only possible in a cumbersome way via the command line and editing files (see https://doc.opensuse.org/documentation/leap/security/html/book-security/cha-security-ldap.html). A basic functionality for editing directory services is to be added to Yast2 with this project.

Deliverable: After completion of the project, basic editing of directory services should be possible with Yast2.

Mentor: Ralf Habacker - co-mentor position is still open, applications welcome

Skills: What knowledge is needed ? ruby, python, bash, systemd, ldap, 389-ds configuration

Skill level: estimated between easy and medium

Project size: Medium project (175 hours) , extendable to Large project (350 hours)

Get started:

• Examine the existing directory services creation module for bugs or improvements and try to submit associated fixes/changes, see for example No output of error messages in the user interface yast/yast-auth-server#78
• Investigate what is frequently customized when editing a directory service to determine potential project scope
• Also a study of the configuration of the 389-ds will help you.
• A good source to understand the structure of YaST2 and the module to be extended are the sources of the corresponding package yast-auth-server and the previously used openLDAP module.

Screenshots:

[AkashKumar7902]

hey @ddemaio, I came across this project in gsoc 2023 under openSUSE. I have experience in python and bash and currently improving my skills in ruby. I would like to work on this project.

[officialasishkumar]

Hey @rhabacker , I have submitted a proposal. I want to discuss further about this project with you. Where can i contact you?

[rhabacker]

Hi @officialasishkumar, thank you for your proposal. I will contact you tomorrow, so we can discuss further details.

[officialasishkumar]

Hi @rhabacker, here are my contact details:
element -> asishkumar:matrix.org
Discord -> Charon#3571
Email -> officialasishkumar@gmail.com

[rhabacker]

Hi @officialasishkumar, thanks for providing your contact information. You already know my username on github, which is used for communication here on github.

The GSoC program prefers public communication, so I suggest we use https://github.com/openSUSE/mentoring/discussions for this.

[rhabacker]

I also suggest to use a prefix for discussions related to this project e.g. yast-389-ds. Perhaps @ddemaio has further advice on this or can set up an appropriate category.

[Firstyear]

Hi there,

I'm the maintainer of 389-ds for SUSE and I wasn't aware that this project was being offered. I have some concerns about it.

This also relates to #200 the other project you have listed.

Currently it's not actually possible to have kerberos and ldap work together in yast. It is impossible to correctly "order" the startup between krb and directory server with systemd which has already resulted in some bugs. As the maintainer I'm also not interested in supporting this configuration. We have already removed it in yast/yast-auth-server@dbe8c33

Additionally we are actively removing directory services from yast - for example: yast/yast-auth-server#80

In order to make this work the whole tool would need to be rewritten to python, and then call into lib389 directly rather than via the current command based interface. While it might be nice to have this, the lib389 apis are internally targeted especially in the setup code (which I wrote pretty much all of) and so there is no guarantee to stability either. That would mean that this needs continual maintenance to ensure it works for the future.

Finally there is already both a scripted and interactive dscreate setup option so having yast offer this is redundant.

I think that directory services is not something that yast can offer here any more given it's scope and scale, especially given that dscreate already is upstream and does everything that's needed. It's actually really easy to use! Have a look at https://www.port389.org/docs/389ds/howto/quickstart.html

So I'm concerned that this project was offered without consultation of myself as the 389 maintainer, especially given the direction we are going with directory services in opensuse.

[Firstyear]

@ddemaio and @rhabacker can you please respond to the above comment ASAP? Given this affects a student I think it deserves prioritisation.