[SSSD] Unexpected behavior with 'simple_allow_users ='

Jakub Hrozek jhrozek at redhat.com
Fri Nov 2 14:05:00 UTC 2012


On Fri, Nov 02, 2012 at 02:50:45PM +0100, Stef Walter wrote:
> On 11/02/2012 01:57 PM, Dmitri Pal wrote:
> > First let us define a general rule about how we treat the cases:
> > X =
> > Is it treated as X being undefined or X having an empty value.
> > It should be a general documented rule for the application.
> >
> > Current behavior is to ignore and I think it is the right one.
> > May be it should be clearly stated in the man for sssd.conf if not yet
> > stated.
> 
> Understood.
> 
> But to me it seems that this policy does not make sense in this
> situation. It's completely counter intuitive that the following, instead
> of allowing no users, allows any user.
> 
> simple_allow_users =
> 
> Sure, you can say that anyone deploying sssd, should read over every
> line of the documentation and be well informed. But there's also
> something to be said for readability and principle-of-least-surprise.

That is exactly what I meant to say with my earlier post.

Again, this is access control. I would prefer to be more paranoid and
defensive than less.



More information about the sssd-devel mailing list