[SSSD] SSSD] [PATCH] AD: Add support for gpo permissive mode

Sumit Bose sbose at redhat.com
Fri Jun 27 12:16:58 UTC 2014


On Fri, May 30, 2014 at 08:52:41AM -0400, Yassir Elley wrote:
> Hi,
> 
> The attached patch adds support for gpo permissive mode. Specifically, if the ad_gpo_access_control option is set to "permissive" (which it is by default), and the gpo-based access control evaluation indicates that the user is denied access, then a syslog message is emitted indicating that the user would have been denied logon access if the option were set to "enforcing".
> 
> In order to simplify sending syslog messages to the security log (with or without journald), I have introduced a generic sss_log_ext function, which can be used with any syslog facility (including our standard "LOG_DAEMON" facility, as well as the security log "LOG_AUTHPRIV" facility).
> 
> This patch depends on a previously submitted patch ("Add initial gpo-smb implementation"), which has not yet been pushed to master.

Can you rebase this patch on top of the latest version of "Add initial
gpo-smb implementation"?

bye,
Sumit
> 
> Regards,
> Yassir.



More information about the sssd-devel mailing list