[SSSD] [PATCH] AD: LDAP component of GPO-based access control

Simo Sorce simo at redhat.com
Tue Apr 15 19:04:59 UTC 2014


On Tue, 2014-04-15 at 20:59 +0200, Jakub Hrozek wrote:
> On Tue, Apr 15, 2014 at 02:49:36PM -0400, Yassir Elley wrote:
> > > > * When we talk about "loudly complaining", is this simply a
> > > > log message with high priority? If so, how high should it be
> > > > (FATAL_FAILURE? CRIT_FAILURE? OP_FAILURE?)
> > > 
> > > I was thinking FATAL_FAILURE. I think a syslog message is probably an
> > > overkill.
> > 
> > You first say that we should output a syslog message with FATAL_FAILURE, but then you say that a syslog message is probably an overkill! Can you clarify?
> > 
> > Regards,
> > Yassir.
> 
> I was considering doing both:
> 
> DEBUG(SSSDBG_FATAL_FAILURE, "User was denied access by GPO!\n");
> sss_log(SSS_LOG_ERR, "User was denied access by GPO!\n");
> 
> But I'm not sure if this would be acceptable or whether the sss_log call
> would pollute the syslog/journal too much..

No it is not too much, it happens only when a user is denied, just like
pam_unix and other modules do.
Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list