Systemwide client config

[vigneshmanick]

Not an issue but more of a question.

From the docs the client config at ~/.opk/config.yml and the server config at /etc/opk/config.yml don't overlap. So a client config is required if the providers used are not the default ones.

I would like to propose/query if it's possible to enforce the client config systemwide so that the users don't have to necessarily have a config file for the admin defined providers.

This way the admin defines/enforces a set of providers that the users can use (for example, internal SSO and Google ) and users don't have to worry about setting up the config themselves. This is similar to how conda enforces systemwide configuration that conflicts with the user defined ones. https://docs.conda.io/projects/conda/en/stable/user-guide/configuration/admin-multi-user-install.html#example-administrator-controlled-installation

Or if all of this is possible already, please let me know.

Thanks!

[EthanHeilman]

That's an interesting idea. An assumption I made with the configs is users are not sshing from machines they ssh'd into. Like the SSH client is a users laptop and the ssh server is a server in a datacenter.

It doesn't seem like a bad idea to have an optional /etc/opk/client_config.yml file that acts as the default. Then users can overwrite this in their home directories if they wish.

[vigneshmanick]

Yes, the scenario you described is also what i am using, logging in from laptop to another server elsewhere but i still need to have the client config present at c:\users\myuser\.opk .

This is ok for one user but if i want to automate the provisioning of devices for all users then it's far easier + safer to just deploy a config at a location that is common to all users e.g c:\program files\opk\confg.yml so that the client can directly use the values from there.

Currently if there is no config in user dir then a warning is shown that a config doesn't exist and the user has to generate one. I believe this process can be made more seamless to the user

• Admin provisions the config,
• deliver to all clients
• user just has to run opkssh login ,
• opkssh uses the central config and if there is a conflict , the system one wins.

In our case we have both windows and linux clients and the home directories are different and the configs have to be added seperately for each OS which is an inconvenience for the users.

[EthanHeilman]

@vigneshmanick Do you want to put together a PR for this?

[vigneshmanick]

My go skills are non existent , i can give it a go (pun intended) but no promises :)