URL:
https://github.com/SSSD/sssd/pull/136
Title: #136: Tlog integration
spbnick commented:
"""
Ah, I see. I understand what you meant regarding enable-files-domain. I'll try to
explain what we're trying to do with tlog.
First of all, session recording should always be disabled by default. No matter if tlog is
present or not.
Next, SSSD will function perfectly, also no matter if tlog is present or not, even if
session recording is enabled and configured. The only problem is the users won't be
able to login if session recording is enabled for them and tlog is not installed.
A little recap on how session recording setup works in SSSD: you get to choose if session
recording is disabled for all, enabled for all, or enabled for some users/groups. In the
latter case you get to choose which users/groups have it enabled. For enabled users SSSD
makes NSS report their shell as tlog, and puts the original shell into an environment
variable when PAM sets up the session, so tlog can start the original shell. So if tlog is
not installed, users simply get non-existing shell.
I was thinking we could just have session recording support built and documented in
manpages unconditionally, and only add it to SSSD dependencies on distros where tlog is
present. However, I worry that RHEL customers will then be misled, because I expect tlog
is not going to be available for RHEL for a while.
So the question is do we build/document session recording conditionally, selected at
configure time, or not. Also, do we add tlog to dependencies if we have session recording
support built.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/136#issuecomment-297999419