[SSSD] should ad-gpo support additional logon rights?

Jakub Hrozek jhrozek at redhat.com
Tue Aug 12 07:49:20 UTC 2014


On Mon, Aug 11, 2014 at 12:10:28PM -0400, Simo Sorce wrote:
> On Mon, 2014-08-11 at 11:59 -0400, Yassir Elley wrote:
> > 
> > In our case, when a user calls "sudo ls", I think it is a three-step
> > procedure:
> > 1) sudo calls pam_authenticate to authenticate the user
> > 2) sudo calls pam_acct_mgmt to make sure that the account is not
> > locked, that the ldap/gpo policies permit the user to run sudo, etc
> > 3) sudo refers to /etc/sudoers to determine if it can perform the sudo
> > action (i.e. "ls").
> > 
> > The GPO Logon Rights relate to step (2) of this procedure.
> 
> Except we do not have a logon right in windows that really matches what
> sudo is/does ... besiodes given sudo does its own authorization checks,
> what's the point of 2 ?

It just occured to me when looking at another SSSD bug that the account
check makes sense if the initial login was performed by other means than
a PAM-aware login method.

For example, the user might have logged in with SSH keys, bypassing the
account phase completely. The user might be expired or locked out. Then,
when this user runs sudo, the account phase ensures that running sudo is
denied even though he might be present in sudoers..



More information about the sssd-devel mailing list