[sssd PR#5241][comment] GPO: respect ad_gpo_implicit_deny when evaluation rules
by sumit-bose
URL: https://github.com/SSSD/sssd/pull/5241
Title: #5241: GPO: respect ad_gpo_implicit_deny when evaluation rules
sumit-bose commented:
"""
> Ah, ok. And shouldn't it work also the other way - if ad_gpo_implicit_deny = False and there is not explicit deny rule then allow access?
yes, but this should already work.
Here is an overview:
```
ad_gpo_implicit_deny = False (default)
- no allow-rules no deny-rules present: all users are allowed
- no allow-rules deny-rules present: all users not in deny-rules are allowed
- allow-rules no deny-rules present: only users in allow-rules are allowed
- allow-rules deny-rules present: only users in allow-rules
and not in deny-rules are allowed
ad_gpo_implicit_deny = True
- no allow-rules no deny-rules present: no users are allowed
- no allow-rules deny-rules present: no users are allowed
- allow-rules no deny-rules present: only users in allow-rules are allowed
- allow-rules deny-rules present: only users in allow-rules
and not in deny-rules are allowed
```
This PR should make sure the `no allow-rules` cases of `ad_gpo_implicit_deny = True` work as expected.
HTH
bye,
Sumit
"""
See the full comment at https://github.com/SSSD/sssd/pull/5241#issuecomment-679046124
3 years, 7 months