Openlmi Provider for Management of the SSSD Client Components

MASARYK UNIVERSITY FACULTY}w¡¢£¤¥¦§¨ OF I !"#$%&'()+,-./012345<yA|NFORMATICS OpenLMI provider for management of the SSSD client components MASTER THESIS Pavel Brezinaˇ Brno, spring 2014 Declaration Hereby I declare, that this paper is my original authorial work, which I have worked out by my own. All sources, references and literature used or ex- cerpted during elaboration of this work are properly cited and listed in complete reference to the due source. Pavel Brezinaˇ Advisor: RNDr. Jan Kasprzak i Acknowledgement I would like to thank my supervisor for his guidance, Ing. Jakub Hrozek for his great mentoring and RNDr. Anna Jonášová and other OpenLMI devel- opers for all their help. ii Abstract The goal of this thesis is to create an SSSD provider for the OpenLMI project, which would allow a local and remote management of the fundamental parts of the SSSD system service through the OpenLMI interface. iii Keywords SSSD, OpenLMI, WBEM, CIM, management, administration iv Contents 1 Introduction ............................3 1.1 Goal of this thesis .......................3 1.2 Thesis organization ......................4 2 Web-Based Enterprise Management ...............5 2.1 Architecture ..........................5 2.1.1 Components . .6 2.1.2 Workflow . .8 2.2 Common Information Model .................8 2.2.1 CIM Infrastructure Specification . .8 2.2.2 CIM Schema . .9 2.2.3 Managed Object Format . .9 2.3 Overview of existing implementations ............ 13 2.3.1 SBLIM . 13 2.3.2 WBEM Services . 13 2.3.3 Windows Management Instrumentation . 14 2.3.4 OpenLMI . 14 3 OpenLMI .............................. 15 3.1 LMI Providers ......................... 15 3.2 LMI Shell ........................... 16 3.2.1 Using the shell . 16 3.3 LMI Scripts .......................... 21 3.3.1 Examples . 21 4 System Security Services Daemon ................ 23 4.1 Main features ......................... 23 4.2 Architecture .......................... 24 4.3 Cache management ...................... 26 4.3.1 Record expiration . 27 4.3.2 Negative cache . 27 4.3.3 Mid-point refresh . 27 4.3.4 Periodic updates . 28 4.3.5 Fast in-memory cache . 29 4.3.6 Caching of sudo rules . 29 4.4 Data Providers ........................ 31 4.5 Responders .......................... 32 4.6 Client applications and libraries ............... 33 1 5 Implementation of OpenLMI SSSD provider .......... 34 5.1 CIM Schema for OpenLMI SSSD provider ......... 34 5.1.1 CIM concepts . 34 5.1.2 First revision . 35 5.1.3 Final schema . 37 5.1.4 Designing classes for SSSD components . 40 5.1.5 Designing classes for SSSD domains and subdomains 42 5.2 Considered solutions ..................... 44 5.2.1 OpenLMI provider is self-sufficient . 44 5.2.2 OpenLMI provider and new SSSD responder . 45 5.2.3 OpenLMI provider and SSSD InfoPipe responder . 47 5.3 InfoPipe responder ...................... 48 5.3.1 D-Bus interface . 49 5.4 Modifying configuration ................... 52 5.4.1 Augeas . 52 5.4.2 Application in SSSD . 53 5.5 Simple SSSD D-Bus API ................... 53 5.5.1 Example usage . 55 5.6 SSSD provider for OpenLMI ................. 56 5.7 SSSD OpenLMI scripts .................... 57 5.7.1 Command interface . 57 6 Conclusion ............................. 59 A SSSD CIM schema: MOF ..................... 60 2 1 Introduction Administration of production and internal servers or workstations in a large enterprise environment is a very difficult task that requires many system experts skilled in various system components. Basically every element of the company IT infrastructure provides different tools for its configuration and monitoring. The system administrator has to be aware of many configuration formats, understand different settings of managed services and then he or she has to find a way how to distribute every single change to each component across all managed computer systems. The Web-Based Enterprise Management (WBEM)1is an open standard that aims at unification of the IT infrastructure management in an enterprise environment. It covers many areas of management and provides tools to further expand its abilities to support new components. Every component is managed by a piece of software called provider that exports its configuration and monitoring options into an object oriented interface. One particular implementation of this standard is the OpenLMI. The OpenLMI2is an open source project that aims to bring WBEM closer to Linux-powered systems by creating providers for standard Linux components such as service and software management, network and firewall configuration, disk maintenance etc. 1.1 Goal of this thesis The goal of this thesis is to create an OpenLMI provider for System Se- curity Services Daemon3(SSSD). SSSD is a system service that manages remote identities and policy information stored in a directory server and implements a sophisticated caching mechanisms to make this data available in offline scenarios. Every identity and policy object is associated with a domain. The domain is a logical unit, a container for related objects. SSSD supports multiple domains to be managed on one machine. 1. http://dmtf.org/standards/wbem 2. http://www.openlmi.org/ 3. https://fedorahosted.org/sssd 3 1. INTRODUCTION The thesis should implement the most fundamental parts of SSSD configuration, in particular: • to enable and disable domains and services • changing debug level of SSSD components • to provide basic information about managed domains 1.2 Thesis organization The second chapter describes the Web-Based Enterprise Management standard in detail. It goes through its architecture and incorporated standards such as Common Information Model and Managed Object Format. Small part is also devoted to existing implementations of this standard. The third chapter is dedicated to the OpenLMI project. It describes its benefits, user interface and introduces several examples of its usage. The next part is about the SSSD service. It thoroughly describes its architecture, components and caching mechanisms. And finally the fifth chapter describes the implementation of the SSSD provider for OpenLMI – its design, pieces and important interfaces. 4 2 Web-Based Enterprise Management Web-Based Enterprise Management (WBEM) is an open standard devel- oped by Distributed Management Task Force (DMTF)1organization. It aims to unify management of system resources in distributed computing environments – from a low level process, network or storage management to a higher level view on the system state and configuration of specific components and provided services. Every managed element is looked upon as an object with attributes and methods. WBEM defines how the objects look like, how to transfer their representation over a network and how to call methods on these objects. It also defines a standard set of supported resources and provides base tem- plates to help extending this set with proprietary or open solutions. To achieve its goal, WBEM widely reuses other DMTF standards, mainly Common Information Model (CIM) which provides the tools for descrip- tion of managed elements as objects and introduces basic concepts of how to work with them. It is, however, quite loose on implementation details as it does not specify several key things to make the management really indepen- dent on underlying technologies and software components. For example, it does not specify a protocol to transfer objects over a network or any specific server architecture. WBEM is basically a standardized implementation of CIM which eliminates these weak points by defining new standards like CIM-XML[6] transfer protocol or by declaring that a server has to be split into a controller and providers that take care of selected components. Besides these it also incorporates other standards that help WBEM to fit into enterprise environments such as Service Location Protocol[7] to lo- cate WBEM servers inside a corporate network or Uniform Resource Iden- tifier[8] to identify and distinguish every managed resource. 2.1 Architecture Web-Based Enterprise Management standard consists of several key components: WBEM server and providers, communication protocol and CIM schema. It does not specify any particular user interface, therefore any kind of command line, graphical or browser user interface can be used to manage 1. A standard development organization: http://www.dmtf.org 5 2. WEB-BASED ENTERPRISE MANAGEMENT remote resources. The architecture is illustrated in Figure 2.1. Access CIM Control Schema User CIM-XML WBEM Server Interface over HTTP Provider ... Provider Operating System Interface Managed System Resources Figure 2.1: Architecture of WBEM 2.1.1 Components This section briefly describes the fundamental components of WBEM standard in the bottom-up order. CIM schema CIM schema defines a set of managed objects. It describes how the objects look like: what attributes do they have, what methods they support and what are the relationships among those objects. For this purpose Common Infor- 6 2. WEB-BASED ENTERPRISE MANAGEMENT mation Model standard and its conceptual object oriented language called Managed Object Format (MOF) are used. More information on these standards can be found in Section 2.2. WBEM provider Provider is a server module that implements selected components of the CIM schema. It basically creates a mapping between operating system resources into a format understood by the server. Many providers are depen- dent on underlying operating system, since each system has usually different interface to access its objects – especially the low level ones. WBEM server WBEM server, which is also often called CIM Object Monitor (CIMOM), is the access point between a client and the providers. It handles user au- thentication and authorization and it uses the schema to route commands and data into a particular provider and to call selected method to complete the operation. Depending on implementation, it may also contain a simple persistent database to be used by the providers. Provider interface The WBEM standard itself does not specify any particular programming interface between the providers and CIMOM thus basically every implementation defines its own API.

Load more