[SSSD] questions about gpo support for offline mode

Yassir Elley yelley at redhat.com
Mon Aug 11 00:05:53 UTC 2014



----- Original Message -----
> 
> 
> ----- Original Message -----
> > On 07/24/2014 01:44 PM, Yassir Elley wrote:
> > > Hi guys,
> > >
> > > With regard to adding support for gpo processing in offline mode, if we
> > > have gpo-guids and policy files cached from previous transactions, then
> > > we
> > > can simply retrieve all the gpo-guids from the cache, construct the
> > > policy
> > > file names, retrieve the policy files from the local GPO_CACHE directory,
> > > and perform the access checks.
> > >
> > > However, I have some questions:
> > >
> > > 1. If we don't have any gpo-guids or policy files cached from previous
> > > transactions, should gpo processing deny access by default (assuming that
> > > gpo_mode is enforcing)?
> > 
> > If we don't have anything cached but some previous transaction was
> > successful (i.e. no policy was configured that time), I'd say we should
> > allow access.
> 
> We should probably behave in the same manner whether we are offline (and
> don't have any gpo-guids cached) or online (and no gpos were found to be
> applicable for the machine). Currently, in the online case, we are denying
> access by default (assuming gpo_mode is set to "enforcing"). In other words,
> if no GPOs are found, we deny access. I think this is a bug, b/c it is
> possible (though unlikely) that not a single gpo is applicable to the client
> machine. While there is such a thing as a Default Domain Policy GPO, it can
> be disabled (not a good idea, but possible).
> 
> Do we agree that we should adopt a default Allow policy for both the offline
> and online cases described above?

Actually, we are already doing the right thing in the online case (default Allow), so I just need to change the offline case to default Allow also.

Yassir.



More information about the sssd-devel mailing list