1 probably before we can call this stable
2 ---------------------------------------
3 * fix usage of strerror() as it is not thread safe
4 * fix race condition when setting signal mask in common/tio.c
5 (using pthread_sigmask() adds a dependency on the pthread library,
6 we should probably just do locking)
7 * find problem with reachability of LDAP server
8 * find out why HAVE_GSSPAI is not always set to what configure outputs
9 * have the daemon run under a special uid/gid
13 * set up (test) connection to LDAP server before creating socket
14 * Debian packaging: maybe remove stuff from /etc/nsswitch.conf on remove or
16 * probably document that you should use libpam-ldap for authentication without
17 exposing the passwords through NSS
18 * document test suite (instructions for setting up environment (server), LDIF
19 file, nsswitch.conf and nss-ldapd.conf)
20 * write more unit tests
21 * maybe support bootparams (check README also)
22 * maybe support publickey (check README also)
23 * maybe support netmasks (check README also)
24 * maybe implement a connection object in the myldap module that is shared
25 by different sessions (sessions need to be cleaned up)
26 * add sanity checking code (e.g. not too large buffer allocation and checking
27 that host, user, etc do not contain funky characters) in all server modules
28 * log some statistics: "passwd=100 shadow=10 host=20 rpc=10" (10 req/minute)
29 * in the server: once the request is done pass the flushing of the buffers to
30 a separate thread so our workers are available to handle new requests
31 * reconfigure or upgrade of Debian package should restart nslcd instead of
32 stop and later on start
33 * tune the filter and parameter buffer sizes
34 * maybe document how to set up automounting in LDAP (Linux and Solaris)
35 * make sure to translate timelimit 0 into timelimit -1 where needed
36 * split out idle checking into separate function so we may be able to call it
37 periodically from elsewhere (e.g. the main loop)
38 * add an option to create an extra socket somewhere (so it may be used with
40 * make I/O timeout between NSS lib and daemon configurable with configure
41 * ethers: also look in ipHostNumber attribute to look up an IPv4 (IPv6)
42 address and return it as an alternative entry
43 * protocols/rpc: the description attribute should be used as an alias?
44 * do more checks with failing LDAP connections (e.g. killing connections)
45 * maybe make myldap code thread-safe (use locking)
46 * review changes in nss_ldap and merge any useful changes
47 * maybe rate-limit LDAP entry warnings
48 * consider returning the canonical value as it is stored in LDAP, not
49 the requested value (they can differ in case)
50 * test non-ASCII characters in fields (mostly cn)
51 * implement attribute defaults (for when they're missing from the directory)
52 * implement attribute overrides (to always return a specific value, no matter
53 what the directory says)
54 * see if we can use LD_LIBRARY_PATH to run our tests in so we don't need to
55 install NSS library in system path
56 * only parse configuration options if they are available on the platform
57 * have some more general mechanism to disable NSS module in nslcd
58 * do not use LDAP_DEPRECATED enabled functions
59 * support searchbase autodetection