On Wed, Aug 13, 2014 at 02:34:10PM +0200, Jakub Hrozek wrote:
On Sun, Aug 10, 2014 at 08:18:46PM -0400, Yassir Elley wrote:
>
>
> ----- Original Message -----
> > On Thu, Jul 31, 2014 at 02:40:02PM -0400, Yassir Elley wrote:
> > > Hi,
> > >
> > > The attached patch adds support for gpo processing in offline mode. While
> > > the code for online mode uses LDAP to determine which gpo-guids are
> > > applicable (and then uses SMB to retrieve policy files), the code in
> > > offline mode simply retrieves all gpo-guids from the cache (and then
> > > retrieves locally cached per-gpo-guid policy files). Note that neither
> > > version checking nor the ad_gpo_cache_timeout option are relevant when in
> > > offline mode.
> > >
> > > Unresolved issues
> > > * if there are no gpo-guids in the cache, the code currently denies
> > > access; i suspect we should be allowing access instead; agree?
> >
> > If all the request ran into completion /and/ yet we found no GPOs, then
> > it means there are no GPOs on the server side, right?
>
> If we found no GPOs after running to completion, then it means that
> there are no *applicable* GPOs on the server side (taking into account the
> hostname, inheritance logic, dacl, supported-cse, etc). That's all that
> matters. There may well be other GPOs on the server side that were *not*
> applicable, but we don't care about those.
Right, then I agree with allowing access.
>
> >
> > If that's true, then I agree. I don't think there is any equivalent of
> > IPA's allow_all, correct?
>
> I think IPA's allow_all is simply the default HBAC rule that allows
> all access. For GPOs, in the absence of any Allow Logon Locally policy
> setting, the default is also to allow all access. In the case of IPA,
> as soon as the allow_all rule is removed, then the semantics become deny
> all (except for those allowed by additional rules). Similarly, as soon as
> a single user/group is added to the Allow Logon Locally policy setting,
> the semantics become deny all (except for the added users/groups).
Yes, exactly.
>
> >
> > > * i don't think offline callbacks are needed, but i'm unclear
about whether
> > > online callbacks are needed; i suspect they are not needed for the access
> > > provider (b/c I don't see them being used by the ad_access_filter
code);
> > > should we trigger a fresh round of gpo processing when transitioning from
> > > offline to online?
> >
> > This is something I'll test, but I suspect that we don't need
additional
> > callbacks. Usually there would be authentication attempt before the
> > access control that would flip the offline state to online.
> >
> > > >
Thanks for the patches, these work for me.
ACK.
master:
d3c6fca0f0d3b1c5d3dda3dcf3de0ae3ae4c0c38
9bda5ab39fc3429191e2272a8be62e230677ecb1
Can you ack the sysdb patch in the thread "TESTS: Add unit tests for the
GPO interface" ? I've changed them to apply on top of these..