----- Original Message -----
----- Original Message -----
> Hi,
>
> The attached patch fixes ticket #2437 (conflicting gpo policy settings not
> being resolved correctly)
>
>
https://fedorahosted.org/sssd/ticket/2437
>
> Regards,
> Yassir.
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>
I discovered some more issues while doing further testing on this ticket
relating to "defined but empty" policy settings (see additional comments on
ticket #2347). I have also made some minor changes to this patch, b/c they
didn't warrant their own ticket. Namely, I have removed some attributes that
we weren't using (AD_AT_USER_EXT_NAMES, etc). I have also fixed the way we
handle machine_ext_names by allowing for the possibility of a "present but
empty" value for AD_AT_MACHINE_EXT_NAMES.
I am attaching a revised path to address these issues.
Regards,
Yassir.
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
I have implemented the new design (described in ticket #2347) in which policy settings are
written (and potentially over-written) to a "GPO Enforcement" object (which I
ended up calling "GPO Result" object) in the sysdb cache. This allows policy
settings to be resolved correctly for both the online and offline cases. It is a
reasonably large patch, but I think the final implementation is cleaner and simpler.
Revised patch is attached.
Regards,
Yassir.