On Fri, Nov 02, 2012 at 02:50:45PM +0100, Stef Walter wrote:
On 11/02/2012 01:57 PM, Dmitri Pal wrote:
> First let us define a general rule about how we treat the cases:
> X =
> Is it treated as X being undefined or X having an empty value.
> It should be a general documented rule for the application.
>
> Current behavior is to ignore and I think it is the right one.
> May be it should be clearly stated in the man for sssd.conf if not yet
> stated.
Understood.
But to me it seems that this policy does not make sense in this
situation. It's completely counter intuitive that the following, instead
of allowing no users, allows any user.
simple_allow_users =
Sure, you can say that anyone deploying sssd, should read over every
line of the documentation and be well informed. But there's also
something to be said for readability and principle-of-least-surprise.
That is exactly what I meant to say with my earlier post.
Again, this is access control. I would prefer to be more paranoid and
defensive than less.