[SSSD] [PATCH] AD: LDAP component of GPO-based access control

Yassir Elley yelley at redhat.com
Thu Mar 13 11:02:41 UTC 2014



----- Original Message -----
> On (12/03/14 18:20), Yassir Elley wrote:
> >Hi,
> >
> >The attached patch implements the LDAP component of the GPO-based access
> >control project. For more details on the project, see
> >https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration.
> >The project is not yet complete, since the SMB component still needs to be
> >implemented. However, this seems like a useful milestone to allow others to
> >review the code. This is my first patch submission to the list, so any
> >feedback is appreciated.
> >
> >In order to exercise the code in your AD environment, you will need to link
> >a GPO to the site, domain, or OUs, associated with the policy target (i.e.
> >domain member computer). Since we are not yet retrieving any policy files
> >(over SMB), there is no access control taking place yet, meaning that any
> >policy settings can be used in the GPOs. The only way to determine what is
> >going on is by examining the logs.
> >
> >In summary, the code currently does the following:
> >1. Determines the DN of the policy target (e.g.
> >"cn=f20-laptop,OU=West,OU=Sales,DC=foo,DC=com")
> >2. Calculates the list of SOM DNs (Site, Domain and OUs) associated with the
> >policy target DN
> >3. Retrieves various LDAP attributes from each SOM DN in order to populate a
> >list of GPLinks (i.e. GPO DN plus GPO Options)
> >4. Creates a prioritized list of GPO DNs based on SOM Priority, Link Order,
> >and GPO Options
> >5. Retrieves various LDAP attributes from each GPO DN in order to populate a
> >list of candidate GPOs
> >6. Converts the candidate list to a filtered list, by removing any GPO that
> >has a DACL which denies the policy target permission to apply the GPO
> >7. It is this filtered list that will be sent to the Short-Lived GPO Child
> >process, which will make the necessary blocking SMB calls
> >
> >Regards,
> >Yassir.
> >
> >
> 
> We changed DEBUG messages recently and your patch cannot be compiled on
> current
> master. Probably, it happened when you rebased patches.
> 
> I am attaching which fixes these problems. And some (probably not all) code
> style issues: trailing whitespaces, tabs instead of spaces ...
> 
> Feel free to squash this patch to yours.
> 
> LS
> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> 

Hmmm... I did notice the recent DEBUG message changes and I went through and fixed each one so it compiled. I must have made a mistake somewhere when merging from my local gpo branch to my local master branch. Thanks for the patch!

Regards,
Yassir.



More information about the sssd-devel mailing list