Sync to Debian for -ldap, drop Ubuntu's -auth-client

[Bryan Quigley]

Steps
Sync libnss-ldap with Debian unstable (265-5)
Sync libpam-ldap with Debian unstable (tested with 186-3 now 186-4)
Remove src:ldap-auth-client from artful archive (and binaries ldap-auth-config, ldap-auth-client)
 * Justification - Ubuntu specific, last updated 20 Dec 2011 to make it arch foreign. Last real update 11 Jul 2008.
Remove src/bin:auth-client-config
 * Justification - Ubuntu specific, last updated 17 Dec 2011 to make it build with dh_python2. Last real updated 11 Jul 2008.

sssd is by far our recommended way to do ldap auth today. We previously dropped to universe with the plan to drop like above some time after 16.04 (see bug 1408478)

These are all related because the majority (All?) of the diffs for libnss-ldap/libpam-ldap is to split them up to use the two Ubuntu specific packages. As we no longer maintain them, we should drop them and revert back to the Debian builds.

$ reverse-depends src:auth-client-config
No reverse dependencies found
$ reverse-depends -b src:auth-client-config
No reverse dependencies found
$ reverse-depends src:ldap-auth-client
Reverse-Recommends
==================
* libnss-ldap (for ldap-auth-config) [Will be fixed by sync]

Reverse-Depends
===============
* libpam-ldap (for ldap-auth-config) [Will be fixed by sync]
$ reverse-depends -b src:ldap-auth-client
No reverse dependencies found

[Christian Ehrhardt  (paelzer)]

Hi Brian,
I wondered are you driving all of this or are you just reporting and expect us to do that?

[Bryan Quigley (bryanquigley)]

Hi Christian,
I'm not sure it's possible to do syncs with how inter dependent the packages are in the Ubuntu versions. I was planning to give it a try this week. If you've got a clear idea of how we should do this, feel free to drive. I was just reporting it as something that I would like to get to.

[Bryan Quigley (bryanquigley)]

Have a PPA to try with: https://launchpad.net/~bryanquigley/+archive/ubuntu/ldap954-take3
(Just did debian-pull-source, then changed last changelog entry to zesty so could test in PPA - but version number hasn't changed, debuild -S -sa, then upload.)

Packages replace the old ones fine (it does prompt for LDAP questions again, but I think that's ok).
If you previously did sudo apt install libnss-ldap (http://pastebin.ubuntu.com/23660760/)
If you previously did sudo apt install ldap-auth-config (http://pastebin.ubuntu.com/23660776/)

[Bryan Quigley (bryanquigley)]

They don't have conflicts, so it looks like we can go for the 'easy' route

[Michael Terry (mterry)]

Looking at this now, I'm thinking this should wait until 17.10 opens (a little too late in the 17.04 cycle to make this switch).

[Bryan Quigley (bryanquigley)]

@mterry Agreed, it's a bit to late now, find to wait for 17.10.

[Nish Aravamudan (nacc)]

I would subscribe ~ubuntu-archive to this and ask for some AA help if there is going to need to be done in a side PPA.

[Bryan Quigley (bryanquigley)]

This should be higher than Wishlist. Many who install Ubuntu's -auth-client packages get a subpar experience.

[Andreas Hasenack (ahasenack)]

We have two big diffs regarding debian:
- we use upstream's /etc/ldap.{conf,secret}; debian uses /etc/pam_ldap{.conf,secret} for pam, and /etc/libnss-ldap.{conf,secret} for nss
- we use ldap-auth-config for configuration, whereas debian uses plain debconf inside each package (pam and nss)

This bug is about the second item above, right? What are your thoughts about the migration of debconf data from ldap-auth-config back into the pam/nss packages?

[Bryan Quigley (bryanquigley)]

This bug is about reverting the full set of Ubuntu changes in these packages (they are intrinsically tied to the Ubuntu specific packages that have been unmaintained for quite some time now). As Ubuntu no longer recommends them (we strongly recommend and only support SSSD instead), my thinking is we should revert fully to what Debian has*.

>What are your thoughts about the migration of debconf data from ldap-auth-config back into the pam/nss packages?
If possible, that's great. I was nervous about corner cases so prompting seemed fine (and was what a sync would do by default).

* I wanted to aim for a Sync because I don't believe these packages are likely to get more attention in Ubuntu as we are strongly pushing in another direction. But that way if people do use them they get the latest fixed from Debian.

[Andreas Hasenack (ahasenack)]

Off the top of my head, I think the config file change is more problematic and less desirable:
- we are following upstream here by using /etc/ldap.{conf,secret}
- if we go back to adopting debian's patch, that means more config files for the user to change: /etc/libpam-ldap.{conf,secret} and /etc/libnss-ldap.{conf,secret}. 4 in total, with duplicated information
- this complicates the upgrade path: two config files need to be split into 4
- honestly, I believe upstream is correct here

Do you have rewritten documentation or a guide that shows how to use sssd? Out of the box it doesn't work, for example. It doesn't even have a config file to start with. Ideally we should have a wizard for it, or debconf questions, just like we have today for lib{nss,pam}-ldap.

Anyway, this bug is not the right forum to discuss it :) Could you start a thread in the ubuntu-server@ mailing list perhaps?

[Bryan Quigley (bryanquigley)]

Thanks Andreas for explaining.

I do see we have a guide for sssd to AD (https://help.ubuntu.com/dev/serverguide/sssd-ad.html) but the docs currently do point to libnss-ldap - I'll look at updating the docs to SSSD before proceeding with this bug.

[Bryan Quigley (bryanquigley)]

The docs have been updated to no longer reference libnss-ldap: https://help.ubuntu.com/lts/serverguide/sssd-ad.html

It appears the SSSD docs have also been improved. Will see about revisiting the rest of this bug.