[SSSD] [PATCH] AD: LDAP component of GPO-based access control
Simo Sorce
simo at redhat.com
Mon Apr 28 12:18:25 UTC 2014
On Mon, 2014-04-28 at 13:59 +0200, Jakub Hrozek wrote:
> On Mon, Apr 28, 2014 at 01:51:42PM +0200, Sumit Bose wrote:
> > On Mon, Apr 28, 2014 at 01:28:00PM +0200, Jakub Hrozek wrote:
> > > On Fri, Apr 18, 2014 at 12:56:27PM -0400, Yassir Elley wrote:
> > > > I agree. I have made the change.
> > > >
> > > > Yassir.
> > > Hi,
> > >
> > > sorry I didn't get to continue the review sooner, but the patch is
> > > massive and I've been trying to get some dbus-related code to master
> > > last week. I hope you don't mind Yassir as you were on a vacation last
> > > week :)
> > >
> > > In general the code is good, I only have some more suggestions about
> > > coding style or talloc hierarchy and one question about the default, see
> > > below.
> > >
> > > > From 3617c7b171a4d7090aa6e4c2673769686b4a5919 Mon Sep 17 00:00:00 2001
> > > > From: Yassir Elley <yelley at redhat.com>
> > > > Date: Mon, 20 Jan 2014 11:17:06 -0500
> > > > Subject: [PATCH] Implemented LDAP component of GPO-based access control
> > >
> > > [...]
> > >
> > > > + There are three supported values for this option:
> > > > + <itemizedlist>
> > > > + <listitem>
> > > > + <para>
> > > > + disabled: GPO-based access control rules
> > > > + are neither evaluated nor enforced.
> > > > + </para>
> > > > + </listitem>
> > > > + <listitem>
> > > > + <para>
> > > > + enforcing: GPO-based access control
> > > > + rules are evaluated and enforced.
> > > > + </para>
> > > > + </listitem>
> > > > + <listitem>
> > > > + <para>
> > > > + permissive: GPO-based access control
> > > > + rules are evaluated, but not enforced.
> > > > + Instead, a syslog message will be
> > > > + emitted indicating that the user would
> > > > + have been denied access if this option's
> > > > + value were set to enforcing.
> > > > + </para>
> > > > + </listitem>
> > > > + </itemizedlist>
> > > > + </para>
> > > > + <para>
> > > > + Default: disabled
> > >
> > > Is there a reason the default is disabled rather than permissive? Don't
> > > we want to identify the cases where a user would be locked out soon?
> > >
> >
> > I think this was based on one of my earlier comments. If there are any
> > issues in the GPO code the access validation might fail even if the
> > default value is permissive.
That would be just a bug and we can tell users the workaround is to set
it disabled.
> Hmm, that makes sense, so the plan is to switch directly to enforcing in
> 1.13 ?
I would really like to have it in permissive by default on the first
release this code goes in.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list