[SSSD] should ad-gpo support additional logon rights?
Jakub Hrozek
jhrozek at redhat.com
Wed Aug 27 12:23:32 UTC 2014
On Tue, Aug 26, 2014 at 03:00:27PM -0400, Yassir Elley wrote:
> Oops. Pls ignore the sentence fragment immediately above.
>
> Let me also clarify the question.
>
> The following is my proposed table for various combinations of gpo_mode and the category (or bucket) which the service maps to. I am only looking at the permit and deny categories here (not interactive, network, etc)
>
> gpo_mode service_category return_value
> ====================================================
> disabled permit EOK immediately (i.e. before any LDAP/SMB calls)
> disabled deny EOK immediately ...
>
> enforcing permit EOK immediately ...
> enforcing deny EACCES immediately ...
>
> permissive permit EOK immediately ...
> permissive deny EOK immediately ...
>
> Do you agree with the above table?
Looks good to me. With the permissive setting we should add a DEBUG
message, though.
More information about the sssd-devel
mailing list