[SSSD] [PATCH] AD: LDAP component of GPO-based access control

Yassir Elley yelley at redhat.com
Thu Apr 3 16:30:17 UTC 2014



----- Original Message -----
> 
> 
> ----- Original Message -----
> > 
> > 
> > ----- Original Message -----
> > > On (12/03/14 18:20), Yassir Elley wrote:
> > > >Hi,
> > > >
> > > >The attached patch implements the LDAP component of the GPO-based access
> > > >control project. For more details on the project, see
> > > >https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration.
> > > >The project is not yet complete, since the SMB component still needs to
> > > >be
> > > >implemented. However, this seems like a useful milestone to allow others
> > > >to
> > > >review the code. This is my first patch submission to the list, so any
> > > >feedback is appreciated.
> > > >
> > > >In order to exercise the code in your AD environment, you will need to
> > > >link
> > > >a GPO to the site, domain, or OUs, associated with the policy target
> > > >(i.e.
> > > >domain member computer). Since we are not yet retrieving any policy
> > > >files
> > > >(over SMB), there is no access control taking place yet, meaning that
> > > >any
> > > >policy settings can be used in the GPOs. The only way to determine what
> > > >is
> > > >going on is by examining the logs.
> > > >
> > > >In summary, the code currently does the following:
> > > >1. Determines the DN of the policy target (e.g.
> > > >"cn=f20-laptop,OU=West,OU=Sales,DC=foo,DC=com")
> > > >2. Calculates the list of SOM DNs (Site, Domain and OUs) associated with
> > > >the
> > > >policy target DN
> > > >3. Retrieves various LDAP attributes from each SOM DN in order to
> > > >populate
> > > >a
> > > >list of GPLinks (i.e. GPO DN plus GPO Options)
> > > >4. Creates a prioritized list of GPO DNs based on SOM Priority, Link
> > > >Order,
> > > >and GPO Options
> > > >5. Retrieves various LDAP attributes from each GPO DN in order to
> > > >populate
> > > >a
> > > >list of candidate GPOs
> > > >6. Converts the candidate list to a filtered list, by removing any GPO
> > > >that
> > > >has a DACL which denies the policy target permission to apply the GPO
> > > >7. It is this filtered list that will be sent to the Short-Lived GPO
> > > >Child
> > > >process, which will make the necessary blocking SMB calls
> > > >
> > > >Regards,
> > > >Yassir.
> > > >
> > > >
> > > 
> > > We changed DEBUG messages recently and your patch cannot be compiled on
> > > current
> > > master. Probably, it happened when you rebased patches.
> > > 
> > > I am attaching which fixes these problems. And some (probably not all)
> > > code
> > > style issues: trailing whitespaces, tabs instead of spaces ...
> > > 
> > > Feel free to squash this patch to yours.
> > > 
> > > LS
> > > 
> > > _______________________________________________
> > > sssd-devel mailing list
> > > sssd-devel at lists.fedorahosted.org
> > > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> > > 
> > 
> > Hmmm... I did notice the recent DEBUG message changes and I went through
> > and
> > fixed each one so it compiled. I must have made a mistake somewhere when
> > merging from my local gpo branch to my local master branch. Thanks for the
> > patch!
> > 
> > Regards,
> > Yassir.
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> > 
> 
> I have attached an updated patch to address Lukas's initial comments.
> 
> Regards,
> Yassir.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> 

I have re-organized the code (and added more comments) and attached an updated patch for code review. I hope this will make it easier to review.

Regards,
Yassir.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Implemented-LDAP-component-of-GPO-based-access-contr.patch
Type: text/x-patch
Size: 93408 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140403/612d966b/attachment.bin>


More information about the sssd-devel mailing list