URL:
https://github.com/SSSD/sssd/pull/530
Title: #530: GPO: Add "thinlinc" to ad_gpo_map_remote_interactive
CendioOssman commented:
"""
I do not think this is a good way to approach this issue. There can
be hundreds of different PAM services that could be mapped to different gpo rules. We do
not want to list them all in man pages and put them as defaults. It would actually worsen
the situation because many admins would not want to use most of the services (I think this
is also the case for thinlinc pam service) and would end up removing them from the
defaults using the '-pam_service_name' syntax in the gpo_map_* options. This is
exactly why the mappings are configurable.
I don't fully agree with you here. This setting is about mapping what kind of service
each PAM service is. That is a statement of fact, not policy. Yes, people might use that
to also control which services are allowed but that is not its stated purpose. So from
that point of view this list should ideally include every service out there, properly
mapped to the correct category.
If it was difficult to find out the documentation for gpo_map_*
settings then I think the real issue is that our documentation is not easy to use (and
unfortunately I do think this is the case and we need to improve this). Could you suggest
what we could do to improve the documentation? Was there something specific that was
confusing or something that you would like to add? I really do not know how people use the
documentation or how they look for it (man, google, blog posts?). Your feedback in this
area would be valuable.
The issue is with the logging. The man page was fairly clear once I figured out what to
look for.
The standard error message gives absolutely no hint as to why access is denied:
```
Mar 8 15:13:51 ubuntu1604 pamtester: pam_sss(thinlinc:account): Access denied for user
ossman: 6 (Permission denied)
```
The debug message at least says that it has to do with GPOs and services, but no clue
beyond that:
```
(Thu Mar 8 15:13:51 2018) [sssd[be[lab.lkpg.cendio.se]]] [ad_gpo_access_send] (0x0400):
service thinlinc maps to Denied
```
I would have preferred if the standard log message informed me that access was denied
because the service thinlinc is not mapped to any GPO rule.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/530#issuecomment-371791167