1 | # $Id$ |
---|
2 | |
---|
3 | =head1 DESCRIPTION |
---|
4 | |
---|
5 | =head1 SPECIFIC SETUP PARAMTERS |
---|
6 | |
---|
7 | =head2 db_conn |
---|
8 | |
---|
9 | The C<libpq> connection parameters, eg a semin colon separated paramaters |
---|
10 | containing the server, the database name, user and password, etc... |
---|
11 | |
---|
12 | =head2 no_pg_utf8 |
---|
13 | |
---|
14 | If set disable utf8 flags from postgresql. You can try this parameter if you |
---|
15 | have issue with non ascii value from database |
---|
16 | |
---|
17 | =head2 remove_old_dpmt |
---|
18 | |
---|
19 | By default when the department is changed on a user account it remains in the |
---|
20 | department group as a secondary department. |
---|
21 | |
---|
22 | Setting C<remove_old_dpmt> to true in the config will force user removal from |
---|
23 | the group when department is changed. |
---|
24 | The user can still be added back later. |
---|
25 | |
---|
26 | =head2 ASyncDynData |
---|
27 | |
---|
28 | Don't compute dynamic attribute at commit but let syncManager do it |
---|
29 | asynchronously. |
---|
30 | |
---|
31 | =head1 FEATURES |
---|
32 | |
---|
33 | =head2 Object Aliases |
---|
34 | |
---|
35 | It is possible to create object being simple alias to another, like symbolic on |
---|
36 | UNIX filesystem or mail alias. |
---|
37 | |
---|
38 | Thoses aliases objects are always resolved when propagating into other base. |
---|
39 | The referenced object can be easilly change and all the data related will be |
---|
40 | propagated. |
---|
41 | |
---|
42 | Only alias for object type C<User> are supported at time. |
---|
43 | |
---|
44 | =head3 Usage Example: |
---|
45 | |
---|
46 | The typical exemple is for attribute C<manager> or attribute C<managedBy>. |
---|
47 | Instead setting them to C<John> you can create an alias C<Director> and when |
---|
48 | C<John> leave just change alias reference to C<Bill>. |
---|
49 | |
---|
50 | =head2 Network managment |
---|
51 | |
---|
52 | Link::Accounts can build automatically some part of your DNS or DHCP |
---|
53 | configuration. |
---|
54 | |
---|
55 | To do this you have to create a C<netzone> object. Such object need a type: |
---|
56 | |
---|
57 | =over 4 |
---|
58 | |
---|
59 | =item dns: to build a DNS zone for classic domain |
---|
60 | |
---|
61 | =item reverse: for reverse IP address (168.192.in-addr.arpa) |
---|
62 | |
---|
63 | =item dhcp: ISC dscpd configuration for fixed address |
---|
64 | |
---|
65 | =item puppet: puppet configuration |
---|
66 | |
---|
67 | =back |
---|
68 | |
---|
69 | The way it works is quite simple, each zone will make the code to write a file |
---|
70 | you can include in your server configuration. The match is done by looking the |
---|
71 | zone IP address masks and the host IPs. |
---|
72 | |
---|
73 | For example someone having a zone named C<private.mydomain.com> having masks |
---|
74 | C<192.168.5.0/24>, and having an host named C<foo> with IP C<192.168.5.3> and |
---|
75 | another host C<bar> with IP C<192.168.13.78>. The zone built will look likes: |
---|
76 | |
---|
77 | foo IN A 192.168.5.3 |
---|
78 | |
---|
79 | As you can see this DNS zone is not valid: the goal of such feature is to make |
---|
80 | the repetive work for us, not to manage the full zone (even such feature could |
---|
81 | be possible). The repetitive work is declaring the hundred computers our users |
---|
82 | have. |
---|
83 | |
---|
84 | The output will be happend to a template have the name of the zone suffixed by |
---|
85 | C<.in>. You can put in this template evering about the zone declaration (SOA, |
---|
86 | NS, TXT...). |
---|
87 | |
---|
88 | =head2 User endcircuit |
---|
89 | |
---|
90 | The C<endcircuit> attribute contain the deadline for people to make |
---|
91 | admnistrative task when starting to work. |
---|
92 | If set this attribute take precedence to C<expire> attribute for computed |
---|
93 | attributes (C<accountExpires> for Active Directory). |
---|
94 | |
---|
95 | Setting C<endCircuitdontExpire> option to the database disable this behavior and |
---|
96 | C<endcircuit> attribute become informationnal only. |
---|
97 | |
---|
98 | =head2 User Employment |
---|
99 | |
---|
100 | The employment object allow you to set time when you're user have a status. This |
---|
101 | allow through 'Employment' module for la-sync-manager to automate changes. |
---|
102 | |
---|
103 | The synchronized attributes are: |
---|
104 | |
---|
105 | =over 4 |
---|
106 | |
---|
107 | =item C<company> |
---|
108 | |
---|
109 | =item C<employer> |
---|
110 | |
---|
111 | =item C<department> |
---|
112 | |
---|
113 | =item C<contratType> |
---|
114 | |
---|
115 | =item C<managerContact> |
---|
116 | |
---|
117 | =item C<expire> |
---|
118 | |
---|
119 | =item C<endcircuit> |
---|
120 | |
---|
121 | =back |
---|
122 | |
---|
123 | To avoid error when modifying user direclty when you're using employment those |
---|
124 | attribute become on user's side become read-only once an employment exists. |
---|
125 | |
---|
126 | You can change this beaviour using C<employment_lock_user> parameter: |
---|
127 | |
---|
128 | By default it is impossible to modify or create past employment. This behavior |
---|
129 | can be changed by settings C<allow_pasted_employment> parameter in base |
---|
130 | configuration. |
---|
131 | |
---|
132 | =over 4 |
---|
133 | |
---|
134 | =item any (default) |
---|
135 | |
---|
136 | Any existing employment lock those attribute, you must |
---|
137 | create another employment to change user status or delete all employements for |
---|
138 | this user. |
---|
139 | |
---|
140 | =item always |
---|
141 | |
---|
142 | The user's attribute are always locked |
---|
143 | |
---|
144 | =item never |
---|
145 | |
---|
146 | The user's attribute are always locked |
---|
147 | |
---|
148 | =item active |
---|
149 | |
---|
150 | Thoses attributes are locked is any employment are still active (ie unfinished |
---|
151 | or coming later). |
---|
152 | |
---|
153 | =item attribute=value |
---|
154 | |
---|
155 | Thoses attributes are read-only if the C<attribute> given contains C<value>, |
---|
156 | C<*> allow to match any value. |
---|
157 | |
---|
158 | =back |
---|
159 | |
---|
160 | When active users become out of any employment all managed attribute are unset |
---|
161 | (except the expire attribute). |
---|
162 | |
---|
163 | A default value for each of this attribute can be set in configuration using |
---|
164 | parameter in form C<unemployment.ATTRIBUTE>. For example |
---|
165 | C<unemployment.contratType=external> will set any C<contratType> to C<external> |
---|
166 | when no employment apply to user anymore. |
---|
167 | |
---|
168 | Only active accounts are modified in this way. |
---|
169 | |
---|
170 | =head3 User endEmployment |
---|
171 | |
---|
172 | This attribute compute the next day the user will leave the company according |
---|
173 | the employment object registered. |
---|
174 | |
---|
175 | The parameter C<employment_delay> give the number of days to ignore when a hole |
---|
176 | exists between two employment. |
---|
177 | |
---|
178 | If no employment are found, if set the date given in C<unemployed_expire> |
---|
179 | database parameter is returned. |
---|
180 | |
---|
181 | =head3 User endStrictEmployment |
---|
182 | |
---|
183 | This attribute compute the next day the user will leave the company according |
---|
184 | the employment object registered. |
---|
185 | |
---|
186 | It does not take C<employment_delay> parameter into account. |
---|
187 | |
---|
188 | If no employment are found, if set the date given in C<unemployed_expire> |
---|
189 | database parameter is returned. |
---|
190 | |
---|
191 | =head3 User endLastEmployment |
---|
192 | |
---|
193 | This attribute return the very last end of all registered employment fr this |
---|
194 | user. |
---|
195 | |
---|
196 | =head3 User endCurrentEmployment |
---|
197 | |
---|
198 | The end of the employment matching current date. |
---|
199 | |
---|
200 | =head3 Account Expiration |
---|
201 | |
---|
202 | When using employment, account expiration are set to match employment. By |
---|
203 | default the expiration is set to C<endEmployment> value. |
---|
204 | |
---|
205 | This behaviour can be changed by setting C<expireOn> parameter into base |
---|
206 | definition: |
---|
207 | |
---|
208 | =over 4 |
---|
209 | |
---|
210 | =item any of endCurrentEmployment, endEmployment, endStrictEmployment, endLastEmployment |
---|
211 | |
---|
212 | =item never |
---|
213 | |
---|
214 | The expire date is left unchanged and must managed manually. |
---|
215 | |
---|
216 | =back |
---|
217 | |
---|
218 | =head2 Group AutoMemberFilter |
---|
219 | |
---|
220 | Group objects contains users members by setting either C<members> or |
---|
221 | C<memberUID> attributes. |
---|
222 | |
---|
223 | Sometimes it can be usefull to have group automatically populated by arbitrary |
---|
224 | rules. |
---|
225 | |
---|
226 | This is possible by setting a filter in the C<autoMemberFilter> attribute, |
---|
227 | The filter format is the same the one used by L<la-search>, the attribute is |
---|
228 | multivaluable. |
---|
229 | |
---|
230 | So for example one can create an account automatically a group containing people |
---|
231 | having "Olivier" as first name: |
---|
232 | |
---|
233 | autoMemberFilter: givenBame=Olivier |
---|
234 | |
---|
235 | A probably more usefull example is a group containing people from two others |
---|
236 | groups: |
---|
237 | |
---|
238 | autoMemberFilter: memberOf=group1 |
---|
239 | autoMemberFilter: memberOf=group2 |
---|
240 | |
---|
241 | The C<members> or C<memberUID> attribute becomes read-only attribute once |
---|
242 | C<autoMemberFilter> attribute is set. |
---|
243 | |
---|
244 | =head2 Aliases AutoMemberFilter |
---|
245 | |
---|
246 | This attribute allow to create automatics dynamics aliases according filter |
---|
247 | rules exactly like L<Group AutoMemberFilter> works. |
---|
248 | |
---|
249 | The C<forward> attributes is automatically set with email address of selected |
---|
250 | user, user w/o email address are ignored. |
---|
251 | |
---|
252 | =head2 Group AutoFromSutype |
---|
253 | |
---|
254 | Group object can be tagged with the C<sutype> attribute. |
---|
255 | |
---|
256 | When C<autoFromSutype> is set the group member will be computed from member of |
---|
257 | all groups having C<sutype> set this value. |
---|
258 | |
---|
259 | The goal of this attribute is to setup magic group like with the |
---|
260 | C<autoMemberFilter> but working even a new group is created. |
---|
261 | |
---|
262 | =head2 Aliases AutoFromSutype |
---|
263 | |
---|
264 | This attribute allow to create automatics dynamics aliases according filter |
---|
265 | rules exactly like L<Group AutoFromSutype> works. |
---|
266 | |
---|
267 | The C<forward> attributes is automatically set with email address of selected |
---|
268 | user, user w/o email address are ignored. |
---|
269 | |
---|
270 | =head2 Statistics |
---|
271 | |
---|
272 | The application provide some statitics tools but they are only based on the |
---|
273 | current data inside the database and are unable to track delete data. |
---|
274 | |
---|
275 | To keep some mesurement you must use C<stat> objects to describe the data you |
---|
276 | want to track, and enable in L<la-sync-manager.ini> the C<Stats> module. |
---|
277 | |
---|
278 | Each attribute of C<Stat> object describe how data must but compute before being |
---|
279 | stored. |
---|
280 | |
---|
281 | =head3 Stat object Attributes |
---|
282 | |
---|
283 | =head4 description |
---|
284 | |
---|
285 | A label about this statistics object |
---|
286 | |
---|
287 | =head4 display |
---|
288 | |
---|
289 | IF set the statistic appear in the menu of the web interface |
---|
290 | |
---|
291 | =head4 otype |
---|
292 | |
---|
293 | The object type this stat is tracking, must be a supported object type |
---|
294 | |
---|
295 | =head4 filter |
---|
296 | |
---|
297 | One or multiple filter to limit the objects taking into account |
---|
298 | |
---|
299 | =head4 attribute |
---|
300 | |
---|
301 | The attribute fetch to compute data |
---|
302 | |
---|
303 | =head4 refFilter |
---|
304 | |
---|
305 | When the attribute reference another type of object this setting allow to |
---|
306 | filter to the matching referenced object. |
---|
307 | |
---|
308 | =head4 refAll |
---|
309 | |
---|
310 | When the attribute reference another type of object non exiting objects in |
---|
311 | the results appear as 0, otherwise they are ignored. |
---|
312 | |
---|
313 | =head4 aggregateFunction |
---|
314 | |
---|
315 | An optionnal operation to do on the data: |
---|
316 | |
---|
317 | =over 4 |
---|
318 | |
---|
319 | =item sum |
---|
320 | |
---|
321 | Make the sum of the result per item |
---|
322 | |
---|
323 | =item avg |
---|
324 | |
---|
325 | Make the average of the result per item |
---|
326 | |
---|
327 | =item count |
---|
328 | |
---|
329 | Count the number of item return |
---|
330 | |
---|
331 | =back |
---|
332 | |
---|
333 | =head4 delay |
---|
334 | |
---|
335 | The number of day between two run |
---|
336 | |
---|
337 | =head4 retention |
---|
338 | |
---|
339 | If set, the duration in days after which stats value must deleted |
---|