LWN: Comments on "New features for Fedora 18"

New features for Fedora 18

ab — Sun, 05 Aug 2012 13:28:19 +0000

Trust between Samba 4 AD DC and IPAv3 is not yet possible because Samba 4 AD DC does not support cross-forest trusts yet. Work is ongoing on that one. Once we'll (Samba Team) get cross-forest trusts working in Samba 4 AD DC, this setup will work automatically with IPAv3 cross-forest AD trusts.

SSSD can work with standalone Samba 4 AD DC domain already, either using LDAP or AD provider, it is cross-forest trusts that are not supported in Samba 4 AD DC yet.

New features for Fedora 18

drag — Fri, 03 Aug 2012 21:44:06 +0000

If I could set up Samba4 standalone with full AD support and then be able to set up some sort of trust relationship with a IPA v3 DC so that users and groups could be managed by either... then that would make me happy and fill the Windows requirements.

Also if SSSD could work with a standalone Samba4 domain then that would be great also.

I don't think that it's entirely necessary for IPA to be a AD compatible DC, although that would be ideal (less admin overhead, less stuff to break, etc). Having a requirement that a administrator must setup a standalone Windows or Samba4 DC then that would be fine, just as long as you can treat both in a identical manner.

Unity

misc — Wed, 01 Aug 2012 20:35:40 +0000

It is already in rawhide and was pushed to F17.

Unity

jspaleta — Wed, 01 Aug 2012 20:24:19 +0000

It wont make F18. But my current understanding is that a version of Unity can make it into Fedora without patches, the tradeoff being that some functionality will not work.

There has been work upstream in recent versions of Unity to close the gap with stock gnome. It should be usable without patches. I'll find out how usable as I work my way up the the dependency chain and get the necessary dependencies in Fedora.

But unless someone else steps up to drives the effort to get Unity and its specialized lib stack through fedora's review process its going to be awhile before I can find the time to put a coherent set of packages together that have the ability to pass review. I'm working on it, but my travel schedule makes it slow going. I'm still willing to review packages if other people beat me to putting packages into the submission que. At the rate I'm going F18 update is possible, but not at release time.

-jef

Unity

dashesy — Wed, 01 Aug 2012 17:01:01 +0000

I do not see any mention of Cinnamon, I really hope it makes it to F18 :)

New features for Fedora 18

ab — Wed, 01 Aug 2012 09:22:00 +0000

IPA v3 will bring trusts with existing AD setup, that's first step. It will not be full blown AD DC but AD will treat IPA v3 users and machines as if they are from a native AD forest which will be enough for majority of use cases.

Getting Samba 4 AD DC out as proper AD DC is also important task. However, it should be viewed also in a perspective of being an application in a larger setup -- if you would run it in an isolated VM, you can already build your own samba4 package in Fedora for that purpose by changing few arguments to build process. It will use embedded Heimdal kerberos implementation. Unfortunately, you then cannot share the same VM with anything else relying on Kerberos in Fedora as those will be build against MIT Kerberos and use by default features unavailable in Heimdal like DIR: credential cache collections.

So in isolated environment it is already possible to build and use Samba 4 AD DC in Fedora 18 (Rawhide right now, of course). Integrating into distribution is a bit large scope and requires more effort.

New features for Fedora 18

drag — Wed, 01 Aug 2012 08:37:40 +0000

Being able to integrate IPA into Samba4 is certainly a very very awesome thing to do. Otherwise Fedora/Redhat will end up supporting two incompatible Kerberos/LDAP-based domain controller implementations.

Hopefully they can pull it off in such a way that no level of Active Directory compatibility will be lost. The ability to have a compatible AD implementation is a such as massive and important killer feature that it would be a fatal mistake to not take compatibility deadly seriously. It would be better to have two incompatible domain controller systems then it would be to have limited Windows/AD compatibility.

All in all it's very exiting. Kudos to the development groups behind this.

So far my experiences using and testing FreeIPA have been insanely positive. This with SSSD is a monumental step forward in terms of usability and effectiveness of Linux systems in a domain environment. Absolutely fantastic stuff. For people who are interested in network security or enterprise level domain controllers and have not taken time to evaluate FreeIPA on a Redhat/CentOS/Fedora system you are doing yourself a huge disservice!

This sort of stuff makes kerberos/ldap integration and support on the OS level deadly simple. Even doing something like taking a Debian host using a older revision of SSSD and having it join a FreeIPA 2 domain is almost laughably simple compared to the hell that was previously required with a more custom solution made up of configuring separate components like OpenLDAP + MIT kerberos.

And thinking that it can be possible to have compatibility with AD and thus be able to integrate Windows hosts naturally with Linux hosts can open up all sorts of new possibilities and markets. Lots of $$$ to be made by Redhat and anybody else that can manage to sell this support to corporations. (hint: Looking at you; Canonical)

Oh and integrating Kerberos support into web apps via the NSS apache module is very simple also. With a couple simple configuration modifications even Chrome/Chromium can support single sign on.

Very very cool stuff altogether.

New features for Fedora 18

ab — Wed, 01 Aug 2012 07:28:55 +0000

Please read the explanation in the feature page. Together with IPA v3 trusts most of use cases will be addressed. There is still work to be done to make MIT Kerberos usable as part of Samba 4 AD DC server setup, hopefully in next Fedora releases we'll be able to adopt it.

FedFS

drag — Wed, 01 Aug 2012 07:06:30 +0000

From the link:

> Fedfs is, in many ways, an addition of automount functionality along the line of something that I believe (as the autofs maintainer both upstream and here in Fedora) has been needed for a long time. That is a distributed autofs mount map resource manager and while fedfs isn't quite what I envisioned for autofs the functionality it provides is fairly close. Just how far integration with autofs will go isn't clear yet.

FedFS

colo — Wed, 01 Aug 2012 05:45:11 +0000

Can anyone explain to me what's the benefit of FedFS over regular autofs? I mean, I can already store autofs maps in LDAP, and the mounting is transparent to userspace. What's the point of FedFS? It seems to be able to do just that, but only for NFS4.

New features for Fedora 18

dwa — Wed, 01 Aug 2012 03:00:30 +0000

That isn't the full list of F18 features - just the ones discussed at that particular meeting.

This gives a much better view of all the accepted features for F18: http://fedoraproject.org/wiki/Category:FeatureAcceptedF18

New features for Fedora 18

rahulsundaram — Wed, 01 Aug 2012 02:16:19 +0000

It clearly says that is the plan on the feature page.

New features for Fedora 18

augustz — Wed, 01 Aug 2012 01:51:53 +0000

I know, I was like huh?

Hopefully this is just the beginning and they can figure out how to add AD DC support back into Samba4 after removing it.

Unity

HelloWorld — Wed, 01 Aug 2012 00:52:40 +0000

How would that happen? As far as I know, Unity still requires patched versions of various libraries such as gtk+, and I don't think Fedora is going to ship those.

New features for Fedora 18

gdt — Tue, 31 Jul 2012 23:32:50 +0000

Shipping Samba4 without the Domain Controller function somewhat misses the point.

Unity

littlesandra88 — Tue, 31 Jul 2012 23:04:11 +0000

I really hope Unity makes it as well for F18.