[SSSD] Unexpected behavior with 'simple_allow_users ='

Stef Walter stefw at redhat.com
Fri Nov 2 13:50:45 UTC 2012


On 11/02/2012 01:57 PM, Dmitri Pal wrote:
> First let us define a general rule about how we treat the cases:
> X =
> Is it treated as X being undefined or X having an empty value.
> It should be a general documented rule for the application.
>
> Current behavior is to ignore and I think it is the right one.
> May be it should be clearly stated in the man for sssd.conf if not yet
> stated.

Understood.

But to me it seems that this policy does not make sense in this
situation. It's completely counter intuitive that the following, instead
of allowing no users, allows any user.

simple_allow_users =

Sure, you can say that anyone deploying sssd, should read over every
line of the documentation and be well informed. But there's also
something to be said for readability and principle-of-least-surprise.

> We should probably add a special value like $none$ to allow explicitly
> setting the filter to block all access.
> Realmd would have to adjust accordingly.

Sure. If this really is the way that sssd wants to handle this, then
realmd can work around the issue with a special value like $none$. As
long as such a string does not run afoul of sssd user name validation or
some such (either now or in the future).

Cheers,

Stef




More information about the sssd-devel mailing list