[SSSD] should ad-gpo support additional logon rights?

Yassir Elley yelley at redhat.com
Wed Aug 27 21:07:13 UTC 2014



----- Original Message -----
> On Tue, Aug 26, 2014 at 03:00:27PM -0400, Yassir Elley wrote:
> > Oops. Pls ignore the sentence fragment immediately above.
> > 
> > Let me also clarify the question.
> > 
> > The following is my proposed table for various combinations of gpo_mode and
> > the category (or bucket) which the service maps to. I am only looking at
> > the permit and deny categories here (not interactive, network, etc)
> > 
> > gpo_mode        service_category        return_value
> > ====================================================
> > disabled         permit                 EOK immediately (i.e. before any
> > LDAP/SMB calls)
> > disabled         deny                   EOK immediately ...
> > 
> > enforcing        permit                 EOK immediately ...
> > enforcing        deny                   EACCES immediately ...
> > 
> > permissive       permit                 EOK immediately ...
> > permissive       deny                   EOK immediately ...
> > 
> > Do you agree with the above table?
> 
> Looks good to me. With the permissive setting we should add a DEBUG
> message, though.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> 

Agreed.



More information about the sssd-devel mailing list