[SSSD] [PATCH] AD: LDAP component of GPO-based access control

Simo Sorce simo at redhat.com
Mon Apr 28 12:18:25 UTC 2014


On Mon, 2014-04-28 at 13:59 +0200, Jakub Hrozek wrote:
> On Mon, Apr 28, 2014 at 01:51:42PM +0200, Sumit Bose wrote:
> > On Mon, Apr 28, 2014 at 01:28:00PM +0200, Jakub Hrozek wrote:
> > > On Fri, Apr 18, 2014 at 12:56:27PM -0400, Yassir Elley wrote:
> > > > I agree. I have made the change.
> > > > 
> > > > Yassir.
> > > Hi,
> > > 
> > > sorry I didn't get to continue the review sooner, but the patch is
> > > massive and I've been trying to get some dbus-related code to master
> > > last week. I hope you don't mind Yassir as you were on a vacation last
> > > week :)
> > > 
> > > In general the code is good, I only have some more suggestions about
> > > coding style or talloc hierarchy and one question about the default, see
> > > below.
> > > 
> > > > From 3617c7b171a4d7090aa6e4c2673769686b4a5919 Mon Sep 17 00:00:00 2001
> > > > From: Yassir Elley <yelley at redhat.com>
> > > > Date: Mon, 20 Jan 2014 11:17:06 -0500
> > > > Subject: [PATCH] Implemented LDAP component of GPO-based access control
> > > 
> > > [...]
> > > 
> > > > +                            There are three supported values for this option:
> > > > +                            <itemizedlist>
> > > > +                                <listitem>
> > > > +                                    <para>
> > > > +                                        disabled: GPO-based access control rules
> > > > +                                        are neither evaluated nor enforced.
> > > > +                                    </para>
> > > > +                                </listitem>
> > > > +                                <listitem>
> > > > +                                    <para>
> > > > +                                        enforcing: GPO-based access control
> > > > +                                        rules are evaluated and enforced.
> > > > +                                    </para>
> > > > +                                </listitem>
> > > > +                                <listitem>
> > > > +                                    <para>
> > > > +                                        permissive: GPO-based access control
> > > > +                                        rules are evaluated, but not enforced.
> > > > +                                        Instead, a syslog message will be
> > > > +                                        emitted indicating that the user would
> > > > +                                        have been denied access if this option's
> > > > +                                        value were set to enforcing.
> > > > +                                    </para>
> > > > +                                </listitem>
> > > > +                            </itemizedlist>
> > > > +                        </para>
> > > > +                        <para>
> > > > +                            Default: disabled
> > > 
> > > Is there a reason the default is disabled rather than permissive? Don't
> > > we want to identify the cases where a user would be locked out soon?
> > > 
> > 
> > I think this was based on one of my earlier comments. If there are any
> > issues in the GPO code the access validation might fail even if the
> > default value is permissive.

That would be just a bug and we can tell users the workaround is to set
it disabled.

> Hmm, that makes sense, so the plan is to switch directly to enforcing in
> 1.13 ?

I would really like to have it in permissive by default on the first
release this code goes in.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York





More information about the sssd-devel mailing list