[SSSD] SSSD] [PATCH] AD: Add support for gpo permissive mode

Jakub Hrozek jhrozek at redhat.com
Tue Jul 1 09:30:44 UTC 2014


On Mon, Jun 30, 2014 at 06:04:43PM +0200, Sumit Bose wrote:
> On Sat, Jun 28, 2014 at 01:51:41AM -0400, Yassir Elley wrote:
> > 
> > 
> > ----- Original Message -----
> > > On Fri, May 30, 2014 at 08:52:41AM -0400, Yassir Elley wrote:
> > > > Hi,
> > > > 
> > > > The attached patch adds support for gpo permissive mode. Specifically, if
> > > > the ad_gpo_access_control option is set to "permissive" (which it is by
> > > > default), and the gpo-based access control evaluation indicates that the
> > > > user is denied access, then a syslog message is emitted indicating that
> > > > the user would have been denied logon access if the option were set to
> > > > "enforcing".
> > > > 
> > > > In order to simplify sending syslog messages to the security log (with or
> > > > without journald), I have introduced a generic sss_log_ext function, which
> > > > can be used with any syslog facility (including our standard "LOG_DAEMON"
> > > > facility, as well as the security log "LOG_AUTHPRIV" facility).
> > > > 
> > > > This patch depends on a previously submitted patch ("Add initial gpo-smb
> > > > implementation"), which has not yet been pushed to master.
> > > 
> > > Can you rebase this patch on top of the latest version of "Add initial
> > > gpo-smb implementation"?
> > > 
> > > bye,
> > > Sumit
> > > > 
> > 
> > Rebased patch attached.
> 
> Permissive mode is working as expected. ACK.
> 
> bye,
> Sumit

Pushed to master:
    588f8fbe74e66cc015f185a5b798173d320a65b5



More information about the sssd-devel mailing list