[SSSD] [PATCH] AD: LDAP component of GPO-based access control

Simo Sorce simo at redhat.com
Mon Apr 14 22:19:12 UTC 2014


On Mon, 2014-04-14 at 17:01 -0400, Yassir Elley wrote:
> 
> ----- Original Message -----
> > On Fri, Apr 11, 2014 at 06:32:05PM -0400, Yassir Elley wrote:
> > > 
> > > 
> > > ----- Original Message -----
> > > > On Thu, Apr 03, 2014 at 12:30:17PM -0400, Yassir Elley wrote:
> > > > > 
> > > > > 
> > > > > ----- Original Message -----
> > > > 
> > > > Hi,
> > > > 
> > > > I've read the patches and did some basic tests. You can find my review
> > > > comments in-line below. I had to add some NULL-checks to make my tests
> > > > work, see details below as well.
> > > 
> > > Thanks for the thorough review. Much appreciated!
> > > 
> > > > 
> > > > In general I think you should add an option to disable the GPO checks to
> > > > be able to resolve regressions in existing setups.
> > > 
> > > I'm not sure I understand this comment. What do you mean by "existing
> > > setups"? If you mean GPO-unaware setups, then the GPO code should not
> > > break any existing regressions. If it did, we would want to know about it,
> > > right?
> > 
> > There might be setup where the GPO would in theory apply to a Linux
> > client running SSSD but since we didn't support it before access was
> > always granted. If now the GPO is evaluated a user might be rejected
> > although he was able to log in before. In this case it should be
> > possible to disable the GPO check to return the previous behaviour
> > without completely disabling access control.
> > 
> 
> For disabling the GPO checks, do you want me to add a disable option
> to the sssd config, or do you want me to add a disable-FEATURE flag to
> the configure script?

shouldn;t we enable it with something like access_provider = gpo
(which would make gpo checks disabled by default as the default access
provider is 'permit')

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list