[SSSD] Unexpected behavior with 'simple_allow_users ='

Dmitri Pal dpal at redhat.com
Fri Nov 2 14:10:56 UTC 2012


On 11/02/2012 09:50 AM, Stef Walter wrote:
> On 11/02/2012 01:57 PM, Dmitri Pal wrote:
>> First let us define a general rule about how we treat the cases:
>> X =
>> Is it treated as X being undefined or X having an empty value.
>> It should be a general documented rule for the application.
>>
>> Current behavior is to ignore and I think it is the right one.
>> May be it should be clearly stated in the man for sssd.conf if not yet
>> stated.
> Understood.
>
> But to me it seems that this policy does not make sense in this
> situation. It's completely counter intuitive that the following, instead
> of allowing no users, allows any user.
>
> simple_allow_users =
>
> Sure, you can say that anyone deploying sssd, should read over every
> line of the documentation and be well informed.

One does not preclude the other. The point about man pages is just to
make a statement explicit not implied. I do not expect everyone to read
it but it is better to be explicit.
>  But there's also
> something to be said for readability and principle-of-least-surprise.

Sure. Whatever we decide should be consistent and logical.
I seems that so far we had the rule that empty values are ignored.
Is it consistent and logical to change it for one attribute?
I doubt but your argument is valid too.
May be the way out is to have a different attribute
simple_default_allow_rule = [all] | [none]
By default it will be "all" meaning that if the simple_allow_users is
not specified or empty then all users are allowed - current behavior
If it is set to none then if the filter is not specified no one is allowed.

Would that be more logical?

>
>> We should probably add a special value like $none$ to allow explicitly
>> setting the filter to block all access.
>> Realmd would have to adjust accordingly.
> Sure. If this really is the way that sssd wants to handle this, then
> realmd can work around the issue with a special value like $none$. 

This is still a discussion.

> As
> long as such a string does not run afoul of sssd user name validation or
> some such (either now or in the future).

$none$ is proposed because AFAIR POSIX does not allow names to start with $.

>
> Cheers,
>
> Stef
>


-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/






More information about the sssd-devel mailing list