[SSSD] [PATCH] AD: LDAP component of GPO-based access control

Yassir Elley yelley at redhat.com
Wed Mar 12 22:20:41 UTC 2014


Hi,

The attached patch implements the LDAP component of the GPO-based access control project. For more details on the project, see https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration. The project is not yet complete, since the SMB component still needs to be implemented. However, this seems like a useful milestone to allow others to review the code. This is my first patch submission to the list, so any feedback is appreciated.

In order to exercise the code in your AD environment, you will need to link a GPO to the site, domain, or OUs, associated with the policy target (i.e. domain member computer). Since we are not yet retrieving any policy files (over SMB), there is no access control taking place yet, meaning that any policy settings can be used in the GPOs. The only way to determine what is going on is by examining the logs.

In summary, the code currently does the following:
1. Determines the DN of the policy target (e.g. "cn=f20-laptop,OU=West,OU=Sales,DC=foo,DC=com")
2. Calculates the list of SOM DNs (Site, Domain and OUs) associated with the policy target DN
3. Retrieves various LDAP attributes from each SOM DN in order to populate a list of GPLinks (i.e. GPO DN plus GPO Options)
4. Creates a prioritized list of GPO DNs based on SOM Priority, Link Order, and GPO Options
5. Retrieves various LDAP attributes from each GPO DN in order to populate a list of candidate GPOs
6. Converts the candidate list to a filtered list, by removing any GPO that has a DACL which denies the policy target permission to apply the GPO
7. It is this filtered list that will be sent to the Short-Lived GPO Child process, which will make the necessary blocking SMB calls

Regards,
Yassir.



-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-AD-Implemented-LDAP-component-of-GPO-based-access-co.patch
Type: text/x-patch
Size: 90880 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140312/86755831/attachment.bin>


More information about the sssd-devel mailing list