----- Original Message -----
On 07/24/2014 01:44 PM, Yassir Elley wrote:
> Hi guys,
>
> With regard to adding support for gpo processing in offline mode, if we
> have gpo-guids and policy files cached from previous transactions, then we
> can simply retrieve all the gpo-guids from the cache, construct the policy
> file names, retrieve the policy files from the local GPO_CACHE directory,
> and perform the access checks.
>
> However, I have some questions:
>
> 1. If we don't have any gpo-guids or policy files cached from previous
> transactions, should gpo processing deny access by default (assuming that
> gpo_mode is enforcing)?
If we don't have anything cached but some previous transaction was
successful (i.e. no policy was configured that time), I'd say we should
allow access.
We should probably behave in the same manner whether we are offline (and don't have
any gpo-guids cached) or online (and no gpos were found to be applicable for the machine).
Currently, in the online case, we are denying access by default (assuming gpo_mode is set
to "enforcing"). In other words, if no GPOs are found, we deny access. I think
this is a bug, b/c it is possible (though unlikely) that not a single gpo is applicable to
the client machine. While there is such a thing as a Default Domain Policy GPO, it can be
disabled (not a good idea, but possible).
Do we agree that we should adopt a default Allow policy for both the offline and online
cases described above?
> 2. If we detect that we are off-line, at what points do we need to attempt
> to recover and perform offline processing (as opposed to simply returning
> an error). Certainly, we should perform offline processing if the initial
> ldap connect response (i.e. sdap_id_op_connect_recv) returns a dp_error of
> DP_ERR_OFFLINE. However, if one of the several ldap search responses (i.e.
> sdap_get_generic_recv) return a dp_error of DP_ERR_OFFLINE, should we
> still attempt to recover? Should we attempt to recover if the smb connect
> or smb read fails (in the gpo_child)?
>
> 3. If the initial ldap connection succeeds, but we go offline at a later
> point (and if the right thing to do is to attempt to recover at that
> point, per question 2), am I correct in assuming that we should discard
> any data received from the server up to then (if any), and behave as if we
> were offline since the connection started?
The consensus on this seems to be that we should only perform offline gpo processing if
the initial ldap_connect response fails with DP_ERR_OFFLINE.
Yassir.