[SSSD] Design Doc review request for AD GPO Integration

Dmitri Pal dpal at redhat.com
Thu Dec 5 20:25:38 UTC 2013


On 12/05/2013 12:37 PM, Yassir Elley wrote:
>
> ----- Original Message -----
>> On Thu, 2013-12-05 at 10:24 -0500, Dmitri Pal wrote:
>>> On 12/04/2013 10:52 PM, Simo Sorce wrote:
>>>> On Wed, 2013-12-04 at 21:28 -0500, Dmitri Pal wrote:
>>>>> My point is that the whole page should be about AD access provider and
>>>>> the GPO is its implementation detail not a generic mechanism.
>>>>> There can be a separate page where you can describe how GPO generally
>>>>> works and reference it. Right now the page creates the impression that
>>>>> we are starting to build generic GPO infrastructure and just make a
>>>>> first step to allow HBAC. IMO this is a wrong impression. We are not
>>>>> planning to build a generic GPO provider at least at the moment. But
>>>>> we
>>>>> need to solve the problem of the AD access control and this is what we
>>>>> are solving without any future commitment to the generic GPO support.
>>>>>
>>>> Well although it is clear we will implement only access related
>>>> functionality for now, I do not see why we should go out of our way to
>>>> make this a strictly access module specific mechanism as a whole.
>>>>
>>>> Most of the code needed here is generic in nature as it deals with
>>>> downloading GPOs, the whole retrieval and download and parsing process
>>>> is quite generic, and should be built in a generic "policy"
>>>> module/binary.
>>>>
>>>> On our side we will just provide a bare bones parser for the actual
>>>> policies we are interested in and integration only with the AD access
>>>> module.
>>>>
>>>> If then someone comes along and provides patches for additional GPOs,
>>>> including parsers and integration code needed for things they are
>>>> interested in (say a plugin to store sudo rules in GPOs) all the better.
>>>>
>>>> Simo.
>>>>
>>> I am not against it if someone comes and implements it as you said. But
>>> we should set clear expectations that we are not building a generic GPO
>>> solution for all use cases out of box and if someone needs to make it
>>> work for other use cases there will be some effort.
>>> I am afraid that once we say the word GPO people would think that we can
>>> do everything with GPO.
>> Yeah people will make wrong conclusions no matter what :-)
>>
>> But we certainly need to document exactly what is supported and what not
>> in the man pages and other SSSD documentation.
>>
>> Simo.
>>
> I have revised the Design Doc to address some of the concerns raised with respect to managing expectations. I have made it clear that we are currently only building the GPO support necessary for the access control use case. Please review.
>
> Thanks,
> Yassir.
>
> PS: From a technical perspective, nothing has changed. The GPO mechanism will be generic and extensible, allowing other GPO plugins to be used. It's just that we will only be providing an implementation for the access control use case.
Thank you for framing it this way. It is much better now.

Technically I have only one comment:
Instead of recommendation section I suggest saying that we will
prototype Option 1 and then decide how it needs to be enhanced and tuned
up so that we address potential performance concerns that we would be
able to assess and measure based on the prototype.

-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/






More information about the sssd-devel mailing list