<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Dear midPoint community,</p>
<p> We have released <a
href="https://wiki.evolveum.com/display/midPoint/SSH+Connector">SSH
Connector</a> for midPoint. This may not sound like much, but in
fact it is a great news. This small step is a culmination of an
effort that took several years to complete. The connector jigsaw
is complete now.<span id="more-7008"></span></p>
<p> SSH Connector allows to execute provisioning scripts by using
the wide-spread SSH protocol. Therefore this is all about the
provisioning scripts. Provisioning scripts are small pieces of
code that supplement provisioning activities. They create and
delete home directories, mailboxes, they supplement provisioning
operations by executing steps that are not available in APIs and
so on. Provisioning scripts are not always necessary. But when
they are, they usually save the day.</p>
<p> The traditional approach to execute provisioning scripts was to
integrate the end code into the connector. Our Active Directory
connector had had an ability to invoke PowerShell scripts for
years. Unfortunately, that has never actually worked very well.
Firstly, the only practical way how to execute scripts on Windows
at that time was Win-RM service. To be politically correct, the
Win-RM leaves much to be desired, its design is not very elegant,
which made the connector somehow problematic and unreliable. Then
the world turned on its head – Microsoft declared that it loves
Linux and there suddenly was an SSH server for Windows.</p>
<p> This was an opportunity to get rid of Win-RM and solve many
problems at once. However, integrating SSH into Active Directory
connector makes very little sense. SSH is not specific to Active
Directory or Windows. Quite the opposite. LDAP connector would
like to have SSH capability as well and it can be useful for
almost all the other connectors. It makes no sense to integrate
the same SSH scripting code into all the connectors. We needed
something else, something new.</p>
<p> MidPoint has a capability to combine several connectors in one
resource for quite some time. This capability was used to create <a
href="https://wiki.evolveum.com/display/midPoint/Manual+Resource+Configuration#ManualResourceConfiguration-Semi-ManualResources">semi-manual
resources</a>. We have extended that capability in midPoint 4.1.
Any connectors can be combined in a single resource, as long as
the combined functionality makes sense. We have used that
opportunity to isolate the Win-RM functionality from AD/LDAP
connector into a separate PowerShell connector. However, the last
piece of the jigsaw was still missing.</p>
<p> That last piece was added last year, when the <a
href="https://wiki.evolveum.com/display/midPoint/SSH+Connector">SSH
Connector 1.0</a> was released. The SSH connector can be added
to Active Directory connector to execute provisioning scripts on
Windows server. This was kind of experiment, however it has
quickly proven its value during last few months. The testing
results show that this is more reliable than the Win-RM method.
After that we have not hesitated a single second and marked the
Win-RM PowerShell connector as deprecated.</p>
<p> The SSH Connector brings a whole new set of opportunities, as
the SSH Connector can be added to any existing ConnId connector.
LDAP connector can now create home directories on file servers.
Database connectors may archive the data before deleting database
records. And so on. The possibilities are countless.</p>
<p> The SSH Connector is still quite simple. Some features still
need to be implemented, such as public key authentication. We will
be more than happy to <a
href="https://github.com/Evolveum/connector-ssh">accept
contributions</a>. However, the connector works quite well. Even
in its first versions it is still much more useful than the things
that we have had before.</p>
<p>(Reposted from <a moz-do-not-send="true"
href="https://evolveum.com/ssh-connector-completes-the-jigsaw/">Evolveum
blog</a>)</p>
<pre class="moz-signature" cols="72">--
Radovan Semancik
Software Architect
evolveum.com</pre>
</body>
</html>