[SSSD] [PATCH] AD: conflicting gpo policy settings not being resolved correctly

Yassir Elley yelley at redhat.com
Fri Sep 12 03:51:02 UTC 2014



----- Original Message -----
> 
> 
> ----- Original Message -----
> > Hi,
> > 
> > The attached patch fixes ticket #2437 (conflicting gpo policy settings not
> > being resolved correctly)
> > 
> > https://fedorahosted.org/sssd/ticket/2437
> > 
> > Regards,
> > Yassir.
> > 
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> > 
> 
> I discovered some more issues while doing further testing on this ticket
> relating to "defined but empty" policy settings (see additional comments on
> ticket #2347). I have also made some minor changes to this patch, b/c they
> didn't warrant their own ticket. Namely, I have removed some attributes that
> we weren't using (AD_AT_USER_EXT_NAMES, etc). I have also fixed the way we
> handle machine_ext_names by allowing for the possibility of a "present but
> empty" value for AD_AT_MACHINE_EXT_NAMES.
> 
> I am attaching a revised path to address these issues.
> 
> Regards,
> Yassir.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> 

I have implemented the new design (described in ticket #2347) in which policy settings are written (and potentially over-written) to a "GPO Enforcement" object (which I ended up calling "GPO Result" object) in the sysdb cache. This allows policy settings to be resolved correctly for both the online and offline cases. It is a reasonably large patch, but I think the final implementation is cleaner and simpler. Revised patch is attached.

Regards,
Yassir.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-AD-GPO-resolve-conflicting-policy-settings-correctly.patch
Type: text/x-patch
Size: 62809 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140911/931f7c9d/attachment.bin>


More information about the sssd-devel mailing list