[SSSD] questions about gpo support for offline mode

Yassir Elley yelley at redhat.com
Thu Jul 31 17:00:48 UTC 2014



----- Original Message -----
> On 07/24/2014 01:44 PM, Yassir Elley wrote:
> > Hi guys,
> >
> > With regard to adding support for gpo processing in offline mode, if we
> > have gpo-guids and policy files cached from previous transactions, then we
> > can simply retrieve all the gpo-guids from the cache, construct the policy
> > file names, retrieve the policy files from the local GPO_CACHE directory,
> > and perform the access checks.
> >
> > However, I have some questions:
> >
> > 1. If we don't have any gpo-guids or policy files cached from previous
> > transactions, should gpo processing deny access by default (assuming that
> > gpo_mode is enforcing)?
> 
> If we don't have anything cached but some previous transaction was
> successful (i.e. no policy was configured that time), I'd say we should
> allow access.

We should probably behave in the same manner whether we are offline (and don't have any gpo-guids cached) or online (and no gpos were found to be applicable for the machine). Currently, in the online case, we are denying access by default (assuming gpo_mode is set to "enforcing"). In other words, if no GPOs are found, we deny access. I think this is a bug, b/c it is possible (though unlikely) that not a single gpo is applicable to the client machine. While there is such a thing as a Default Domain Policy GPO, it can be disabled (not a good idea, but possible).

Do we agree that we should adopt a default Allow policy for both the offline and online cases described above?

> 
> > 2. If we detect that we are off-line, at what points do we need to attempt
> > to recover and perform offline processing (as opposed to simply returning
> > an error). Certainly, we should perform offline processing if the initial
> > ldap connect response (i.e. sdap_id_op_connect_recv) returns a dp_error of
> > DP_ERR_OFFLINE. However, if one of the several ldap search responses (i.e.
> > sdap_get_generic_recv) return a dp_error of DP_ERR_OFFLINE, should we
> > still attempt to recover? Should we attempt to recover if the smb connect
> > or smb read fails (in the gpo_child)?
> >
> > 3. If the initial ldap connection succeeds, but we go offline at a later
> > point (and if the right thing to do is to attempt to recover at that
> > point, per question 2), am I correct in assuming that we should discard
> > any data received from the server up to then (if any), and behave as if we
> > were offline since the connection started?

The consensus on this seems to be that we should only perform offline gpo processing if the initial ldap_connect response fails with DP_ERR_OFFLINE.

Yassir.




More information about the sssd-devel mailing list