[SSSD] should ad-gpo support additional logon rights?

Simo Sorce simo at redhat.com
Thu Jun 26 17:33:04 UTC 2014


On Thu, 2014-06-26 at 04:54 -0400, Yassir Elley wrote:
> Hi Simo,
> 
> I'd like to wrap up this discussion. I propose that we support only
> the InteractiveLogonRight (for the pam services you mentioned:
> "login", "*dm, "su*"), and on the RemoteInteractiveLogonRight (for the
> "ssh" pam service). We should not support the NetworkLogonRight since
> it is difficult to implement. Do you agree with this proposal?

Well I guess the answer depends on what do you plan to do for pam
services that are not listed ?
Do you always deny access ? Always permit ?

I think a more reasonable workaround is to define a default type, and a
list of mappings.

If a PAM service is explicitly mapped you use that Right to decide,
otherwise the decision falls back to the "default" Right.
Actually the default right could well be actually NetworkLogonRight or
InteractiveLogonRight or something else. As long as you can change the
mappings locally through some configuration that would allow the admin
to add mappings according to their needs. Of course strong guidance
on which mappings should be used for specific type of services should be
provided.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list