----- Original Message -----
On (01/09/14 22:02), Yassir Elley wrote:
>
>
>----- Original Message -----
>> ehlo,
>>
>> If there is a problem with GPO configuration on AD, then function
>> ad_gpo_access_done set error to the request and authentication was
>> rejected
>> with pam system error. It should not happen in permissive mode.
>>
>> Patch is attached. I can modify debug messages or add some logging to the
>> syslog. Any suggestion is welcomed.
>>
>> LS
>>
>
>Good catch. I would suggest two changes:
>* display ret before sss_sterror(ret) in the DEBUG message
>* add the syslog message we use in other places in which we would have
>failed had the mode been "enforcing"
>
>In other words:
>
> if (mode == GPO_ACCESS_CONTROL_ENFORCING) {
> tevent_req_error(req, ret);
> } else {
> DEBUG(SSSDBG_OP_FAILURE,
> "Ignoring error:[%d](%s); GPO-based access control failed,"
> " but GPO is not in enforcing mode.\n",
> ret, sss_strerror(ret));
> sss_log_ext(SSS_LOG_WARNING, LOG_AUTHPRIV, "Warning: user would " \
> "have been denied GPO-based logon access if the " \
> "ad_gpo_access_control option were set to enforcing " \
> "mode.");
> tevent_req_done(req);
Thank you very much for suggestion.
Updated version is attached.
LS
Ack.
Regards,
Yassir.