[SSSD] questions about gpo support for offline mode

Pavel Březina pbrezina at redhat.com
Thu Jul 24 11:52:34 UTC 2014


On 07/24/2014 01:44 PM, Yassir Elley wrote:
> Hi guys,
>
> With regard to adding support for gpo processing in offline mode, if we have gpo-guids and policy files cached from previous transactions, then we can simply retrieve all the gpo-guids from the cache, construct the policy file names, retrieve the policy files from the local GPO_CACHE directory, and perform the access checks.
>
> However, I have some questions:
>
> 1. If we don't have any gpo-guids or policy files cached from previous transactions, should gpo processing deny access by default (assuming that gpo_mode is enforcing)?

If we don't have anything cached but some previous transaction was 
successful (i.e. no policy was configured that time), I'd say we should 
allow access.

> 2. If we detect that we are off-line, at what points do we need to attempt to recover and perform offline processing (as opposed to simply returning an error). Certainly, we should perform offline processing if the initial ldap connect response (i.e. sdap_id_op_connect_recv) returns a dp_error of DP_ERR_OFFLINE. However, if one of the several ldap search responses (i.e. sdap_get_generic_recv) return a dp_error of DP_ERR_OFFLINE, should we still attempt to recover? Should we attempt to recover if the smb connect or smb read fails (in the gpo_child)?
>
> 3. If the initial ldap connection succeeds, but we go offline at a later point (and if the right thing to do is to attempt to recover at that point, per question 2), am I correct in assuming that we should discard any data received from the server up to then (if any), and behave as if we were offline since the connection started?
>
> Thanks,
> Yassir.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>




More information about the sssd-devel mailing list