[SSSD] [PATCH] AD: LDAP component of GPO-based access control
Simo Sorce
simo at redhat.com
Tue Apr 15 19:04:59 UTC 2014
On Tue, 2014-04-15 at 20:59 +0200, Jakub Hrozek wrote:
> On Tue, Apr 15, 2014 at 02:49:36PM -0400, Yassir Elley wrote:
> > > > * When we talk about "loudly complaining", is this simply a
> > > > log message with high priority? If so, how high should it be
> > > > (FATAL_FAILURE? CRIT_FAILURE? OP_FAILURE?)
> > >
> > > I was thinking FATAL_FAILURE. I think a syslog message is probably an
> > > overkill.
> >
> > You first say that we should output a syslog message with FATAL_FAILURE, but then you say that a syslog message is probably an overkill! Can you clarify?
> >
> > Regards,
> > Yassir.
>
> I was considering doing both:
>
> DEBUG(SSSDBG_FATAL_FAILURE, "User was denied access by GPO!\n");
> sss_log(SSS_LOG_ERR, "User was denied access by GPO!\n");
>
> But I'm not sure if this would be acceptable or whether the sss_log call
> would pollute the syslog/journal too much..
No it is not too much, it happens only when a user is denied, just like
pam_unix and other modules do.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list