[SSSD] Design Doc review request for AD GPO Integration

Dmitri Pal dpal at redhat.com
Thu Dec 5 15:24:28 UTC 2013


On 12/04/2013 10:52 PM, Simo Sorce wrote:
> On Wed, 2013-12-04 at 21:28 -0500, Dmitri Pal wrote:
>> My point is that the whole page should be about AD access provider and
>> the GPO is its implementation detail not a generic mechanism.
>> There can be a separate page where you can describe how GPO generally
>> works and reference it. Right now the page creates the impression that
>> we are starting to build generic GPO infrastructure and just make a
>> first step to allow HBAC. IMO this is a wrong impression. We are not
>> planning to build a generic GPO provider at least at the moment. But
>> we
>> need to solve the problem of the AD access control and this is what we
>> are solving without any future commitment to the generic GPO support.
>>
> Well although it is clear we will implement only access related
> functionality for now, I do not see why we should go out of our way to
> make this a strictly access module specific mechanism as a whole.
>
> Most of the code needed here is generic in nature as it deals with
> downloading GPOs, the whole retrieval and download and parsing process
> is quite generic, and should be built in a generic "policy"
> module/binary.
>
> On our side we will just provide a bare bones parser for the actual
> policies we are interested in and integration only with the AD access
> module.
>
> If then someone comes along and provides patches for additional GPOs,
> including parsers and integration code needed for things they are
> interested in (say a plugin to store sudo rules in GPOs) all the better.
>
> Simo.
>

I am not against it if someone comes and implements it as you said. But
we should set clear expectations that we are not building a generic GPO
solution for all use cases out of box and if someone needs to make it
work for other use cases there will be some effort.
I am afraid that once we say the word GPO people would think that we can
do everything with GPO.

-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/






More information about the sssd-devel mailing list