[SSSD] [PATCH] AD: LDAP component of GPO-based access control
Jakub Hrozek
jhrozek at redhat.com
Mon Apr 28 11:59:24 UTC 2014
On Mon, Apr 28, 2014 at 01:51:42PM +0200, Sumit Bose wrote:
> On Mon, Apr 28, 2014 at 01:28:00PM +0200, Jakub Hrozek wrote:
> > On Fri, Apr 18, 2014 at 12:56:27PM -0400, Yassir Elley wrote:
> > > I agree. I have made the change.
> > >
> > > Yassir.
> > Hi,
> >
> > sorry I didn't get to continue the review sooner, but the patch is
> > massive and I've been trying to get some dbus-related code to master
> > last week. I hope you don't mind Yassir as you were on a vacation last
> > week :)
> >
> > In general the code is good, I only have some more suggestions about
> > coding style or talloc hierarchy and one question about the default, see
> > below.
> >
> > > From 3617c7b171a4d7090aa6e4c2673769686b4a5919 Mon Sep 17 00:00:00 2001
> > > From: Yassir Elley <yelley at redhat.com>
> > > Date: Mon, 20 Jan 2014 11:17:06 -0500
> > > Subject: [PATCH] Implemented LDAP component of GPO-based access control
> >
> > [...]
> >
> > > + There are three supported values for this option:
> > > + <itemizedlist>
> > > + <listitem>
> > > + <para>
> > > + disabled: GPO-based access control rules
> > > + are neither evaluated nor enforced.
> > > + </para>
> > > + </listitem>
> > > + <listitem>
> > > + <para>
> > > + enforcing: GPO-based access control
> > > + rules are evaluated and enforced.
> > > + </para>
> > > + </listitem>
> > > + <listitem>
> > > + <para>
> > > + permissive: GPO-based access control
> > > + rules are evaluated, but not enforced.
> > > + Instead, a syslog message will be
> > > + emitted indicating that the user would
> > > + have been denied access if this option's
> > > + value were set to enforcing.
> > > + </para>
> > > + </listitem>
> > > + </itemizedlist>
> > > + </para>
> > > + <para>
> > > + Default: disabled
> >
> > Is there a reason the default is disabled rather than permissive? Don't
> > we want to identify the cases where a user would be locked out soon?
> >
>
> I think this was based on one of my earlier comments. If there are any
> issues in the GPO code the access validation might fail even if the
> default value is permissive.
>
> bye,
> Sumit
Hmm, that makes sense, so the plan is to switch directly to enforcing in
1.13 ?
More information about the sssd-devel
mailing list