[SSSD] [PATCH] AD: LDAP component of GPO-based access control

Jakub Hrozek jhrozek at redhat.com
Mon Apr 28 11:59:24 UTC 2014


On Mon, Apr 28, 2014 at 01:51:42PM +0200, Sumit Bose wrote:
> On Mon, Apr 28, 2014 at 01:28:00PM +0200, Jakub Hrozek wrote:
> > On Fri, Apr 18, 2014 at 12:56:27PM -0400, Yassir Elley wrote:
> > > I agree. I have made the change.
> > > 
> > > Yassir.
> > Hi,
> > 
> > sorry I didn't get to continue the review sooner, but the patch is
> > massive and I've been trying to get some dbus-related code to master
> > last week. I hope you don't mind Yassir as you were on a vacation last
> > week :)
> > 
> > In general the code is good, I only have some more suggestions about
> > coding style or talloc hierarchy and one question about the default, see
> > below.
> > 
> > > From 3617c7b171a4d7090aa6e4c2673769686b4a5919 Mon Sep 17 00:00:00 2001
> > > From: Yassir Elley <yelley at redhat.com>
> > > Date: Mon, 20 Jan 2014 11:17:06 -0500
> > > Subject: [PATCH] Implemented LDAP component of GPO-based access control
> > 
> > [...]
> > 
> > > +                            There are three supported values for this option:
> > > +                            <itemizedlist>
> > > +                                <listitem>
> > > +                                    <para>
> > > +                                        disabled: GPO-based access control rules
> > > +                                        are neither evaluated nor enforced.
> > > +                                    </para>
> > > +                                </listitem>
> > > +                                <listitem>
> > > +                                    <para>
> > > +                                        enforcing: GPO-based access control
> > > +                                        rules are evaluated and enforced.
> > > +                                    </para>
> > > +                                </listitem>
> > > +                                <listitem>
> > > +                                    <para>
> > > +                                        permissive: GPO-based access control
> > > +                                        rules are evaluated, but not enforced.
> > > +                                        Instead, a syslog message will be
> > > +                                        emitted indicating that the user would
> > > +                                        have been denied access if this option's
> > > +                                        value were set to enforcing.
> > > +                                    </para>
> > > +                                </listitem>
> > > +                            </itemizedlist>
> > > +                        </para>
> > > +                        <para>
> > > +                            Default: disabled
> > 
> > Is there a reason the default is disabled rather than permissive? Don't
> > we want to identify the cases where a user would be locked out soon?
> > 
> 
> I think this was based on one of my earlier comments. If there are any
> issues in the GPO code the access validation might fail even if the
> default value is permissive.
> 
> bye,
> Sumit

Hmm, that makes sense, so the plan is to switch directly to enforcing in
1.13 ?



More information about the sssd-devel mailing list