[SSSD] [PATCH] AD: LDAP component of GPO-based access control

Yassir Elley yelley at redhat.com
Mon Apr 14 21:01:13 UTC 2014



----- Original Message -----
> On Fri, Apr 11, 2014 at 06:32:05PM -0400, Yassir Elley wrote:
> > 
> > 
> > ----- Original Message -----
> > > On Thu, Apr 03, 2014 at 12:30:17PM -0400, Yassir Elley wrote:
> > > > 
> > > > 
> > > > ----- Original Message -----
> > > 
> > > Hi,
> > > 
> > > I've read the patches and did some basic tests. You can find my review
> > > comments in-line below. I had to add some NULL-checks to make my tests
> > > work, see details below as well.
> > 
> > Thanks for the thorough review. Much appreciated!
> > 
> > > 
> > > In general I think you should add an option to disable the GPO checks to
> > > be able to resolve regressions in existing setups.
> > 
> > I'm not sure I understand this comment. What do you mean by "existing
> > setups"? If you mean GPO-unaware setups, then the GPO code should not
> > break any existing regressions. If it did, we would want to know about it,
> > right?
> 
> There might be setup where the GPO would in theory apply to a Linux
> client running SSSD but since we didn't support it before access was
> always granted. If now the GPO is evaluated a user might be rejected
> although he was able to log in before. In this case it should be
> possible to disable the GPO check to return the previous behaviour
> without completely disabling access control.
> 

For disabling the GPO checks, do you want me to add a disable option to the sssd config, or do you want me to add a disable-FEATURE flag to the configure script?

Thanks,
Yassir.



More information about the sssd-devel mailing list