Sandstorm should be able to read a user's quota information from LDAP

[paulproteus]

Context:

• A hosting control panel app, such as WHMCS, needs a way to remotely change the quota of a Sandstorm user, based on changes in the user's billing status.

Plan:

• Have a way to configure an LDAP field that stores a user's quota.
• In the Sandstorm functions that check if a user is over quota, check LDAP synchronously for the user's current quota value, to avoid data-race problems reading from LDAP.
• If LDAP is down, or takes more than (let's say) 2 seconds to respond, then assume the user has infinite quota (and log a message so the admin can debug that this happened) - aka "fail open".

Open questions:

• How does this interact with the Sandstorm distinction between "accounts" and "identities"? @jparyani curious for your thoughts on that.

Previous proposal:

• Add a Sandstorm command e.g. "sudo sandstorm set-quota-for-account {{accountId}} {{storageQuotaInBytes}}" that you would run over SSH.

[fgiorlando]

It would be good if this information also showed up in the sandstorm admin panel. I wonder if it may even be simpler to have sandstorm pull data from LDAP so that user details and quota can be maintained and administered by standard methods.

This would work well for account management too, as there are tools for adding users to LDAP in WHMCS: https://github.com/pawl/WHMCS_LDAP It wouldn't to be too hard to modify this so that the basic use case would be:

This would seem the simplest way to ensure the data is consistent.

[paulproteus]

Hi @fgiorlando ,

I'm hopeful we can nail-down the technical requirements here.

I listed a few possible ways to implement it here:

https://oasis.sandstorm.io/shared/JdeIxfJZN78awrUCt7psa6Lpc-Go10477GwDM8XJ2ib

along with some remarks on their upsides and downsides.

Let's discuss that here, so that we can reach a confident conclusion of how the data flow should work, so we can implement what you need!