[SSSD] SSSD] [PATCH] AD: Add support for gpo permissive mode

Yassir Elley yelley at redhat.com
Fri May 30 12:52:41 UTC 2014


Hi,

The attached patch adds support for gpo permissive mode. Specifically, if the ad_gpo_access_control option is set to "permissive" (which it is by default), and the gpo-based access control evaluation indicates that the user is denied access, then a syslog message is emitted indicating that the user would have been denied logon access if the option were set to "enforcing".

In order to simplify sending syslog messages to the security log (with or without journald), I have introduced a generic sss_log_ext function, which can be used with any syslog facility (including our standard "LOG_DAEMON" facility, as well as the security log "LOG_AUTHPRIV" facility).

This patch depends on a previously submitted patch ("Add initial gpo-smb implementation"), which has not yet been pushed to master.

Regards,
Yassir.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-AD-GPO-Add-support-for-gpo-permissive-mode.patch
Type: text/x-patch
Size: 5078 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140530/5e205416/attachment.bin>


More information about the sssd-devel mailing list