On Fri, May 30, 2014 at 08:52:41AM -0400, Yassir Elley wrote:
Hi,
The attached patch adds support for gpo permissive mode. Specifically, if the
ad_gpo_access_control option is set to "permissive" (which it is by default),
and the gpo-based access control evaluation indicates that the user is denied access, then
a syslog message is emitted indicating that the user would have been denied logon access
if the option were set to "enforcing".
In order to simplify sending syslog messages to the security log (with or without
journald), I have introduced a generic sss_log_ext function, which can be used with any
syslog facility (including our standard "LOG_DAEMON" facility, as well as the
security log "LOG_AUTHPRIV" facility).
This patch depends on a previously submitted patch ("Add initial gpo-smb
implementation"), which has not yet been pushed to master.
Can you rebase this patch on top of the latest version of "Add initial
gpo-smb implementation"?
bye,
Sumit
Regards,
Yassir.