[SSSD] [PATCH] GPO: Fix crash with GPO and missing security descriptor

Lukas Slebodnik lslebodn at redhat.com
Wed Apr 29 13:12:35 UTC 2015


On (29/04/15 14:54), Jakub Hrozek wrote:
>On Wed, Apr 29, 2015 at 02:48:28PM +0200, Lukas Slebodnik wrote:
>> On (29/04/15 14:19), Jakub Hrozek wrote:
>> >On Wed, Apr 29, 2015 at 08:00:02AM -0400, Stephen Gallagher wrote:
>> >> "BUG: No attrs found for GPO [%s]. This was likely caused by the GPO
>> >> entry being a referred to another domain controller. SSSD does not yet
>> >> support this configuration. See [insert SSSD bug number] for more
>> >> information."
>> >
>> >I would also prefer to log into syslog/journal via sss_log() in this
>> >case, to get admin's attention easily.
>> It would be supperfluos.
>> We will fail and there should be log message
>>             sss_log_ext(SSS_LOG_WARNING, LOG_AUTHPRIV, "Warning: user would " \
>>                         "have been denied GPO-based logon access if the " \
>>                         "ad_gpo_access_control option were set to enforcing " \
>>                         "mode.");
>> 
>
>Would this message also appear in enforcing mode? Remember there is
>still Stephen's patch on the list to switch the default to enforcing.
>
>Also, the message really doesn't tell anything about the cause of the
>denial.
User will be able to authenticate in permissive mode and we will write message
to syslog. If administrator is interested then it will enable debugging in sssd
and investigate issue. In this case syslog message make sense.

In enforcing mode, user will not be able to authenticate and administrator will
have to investigate issue anyway. So there is not reason for syslog message.

If we really want to help admin with investigation then better way would be to
enable logging to journald by default (messages with log levels <=2).

Unfortunately, there is many false positives with AD :-(.

LS



More information about the sssd-devel mailing list