[SSSD] [PATCH] GPO: Fix crash with GPO and missing security descriptor

Jakub Hrozek jhrozek at redhat.com
Wed Apr 29 13:28:21 UTC 2015


On Wed, Apr 29, 2015 at 03:12:35PM +0200, Lukas Slebodnik wrote:
> On (29/04/15 14:54), Jakub Hrozek wrote:
> >On Wed, Apr 29, 2015 at 02:48:28PM +0200, Lukas Slebodnik wrote:
> >> On (29/04/15 14:19), Jakub Hrozek wrote:
> >> >On Wed, Apr 29, 2015 at 08:00:02AM -0400, Stephen Gallagher wrote:
> >> >> "BUG: No attrs found for GPO [%s]. This was likely caused by the GPO
> >> >> entry being a referred to another domain controller. SSSD does not yet
> >> >> support this configuration. See [insert SSSD bug number] for more
> >> >> information."
> >> >
> >> >I would also prefer to log into syslog/journal via sss_log() in this
> >> >case, to get admin's attention easily.
> >> It would be supperfluos.
> >> We will fail and there should be log message
> >>             sss_log_ext(SSS_LOG_WARNING, LOG_AUTHPRIV, "Warning: user would " \
> >>                         "have been denied GPO-based logon access if the " \
> >>                         "ad_gpo_access_control option were set to enforcing " \
> >>                         "mode.");
> >> 
> >
> >Would this message also appear in enforcing mode? Remember there is
> >still Stephen's patch on the list to switch the default to enforcing.
> >
> >Also, the message really doesn't tell anything about the cause of the
> >denial.
> User will be able to authenticate in permissive mode and we will write message
> to syslog. If administrator is interested then it will enable debugging in sssd
> and investigate issue. In this case syslog message make sense.
> 
> In enforcing mode, user will not be able to authenticate and administrator will
> have to investigate issue anyway. So there is not reason for syslog message.
          ~~~~~~~~~~~~~~~~~~~~~~~
this would be easier with a syslog message.

At least make the debug message level 0 so it always appears.



More information about the sssd-devel mailing list