[SSSD] should ad-gpo support additional logon rights?

Jakub Hrozek jhrozek at redhat.com
Wed Aug 27 12:23:32 UTC 2014


On Tue, Aug 26, 2014 at 03:00:27PM -0400, Yassir Elley wrote:
> Oops. Pls ignore the sentence fragment immediately above.
> 
> Let me also clarify the question.
> 
> The following is my proposed table for various combinations of gpo_mode and the category (or bucket) which the service maps to. I am only looking at the permit and deny categories here (not interactive, network, etc)
> 
> gpo_mode        service_category        return_value
> ====================================================
> disabled         permit                 EOK immediately (i.e. before any LDAP/SMB calls)
> disabled         deny                   EOK immediately ...
> 
> enforcing        permit                 EOK immediately ...
> enforcing        deny                   EACCES immediately ...
> 
> permissive       permit                 EOK immediately ...
> permissive       deny                   EOK immediately ...
> 
> Do you agree with the above table?

Looks good to me. With the permissive setting we should add a DEBUG
message, though.



More information about the sssd-devel mailing list