[SSSD] [PATCH] GPO: Fix crash with GPO and missing security descriptor

Lukas Slebodnik lslebodn at redhat.com
Wed Apr 29 13:35:02 UTC 2015


On (29/04/15 15:28), Jakub Hrozek wrote:
>On Wed, Apr 29, 2015 at 03:12:35PM +0200, Lukas Slebodnik wrote:
>> On (29/04/15 14:54), Jakub Hrozek wrote:
>> >On Wed, Apr 29, 2015 at 02:48:28PM +0200, Lukas Slebodnik wrote:
>> >> On (29/04/15 14:19), Jakub Hrozek wrote:
>> >> >On Wed, Apr 29, 2015 at 08:00:02AM -0400, Stephen Gallagher wrote:
>> >> >> "BUG: No attrs found for GPO [%s]. This was likely caused by the GPO
>> >> >> entry being a referred to another domain controller. SSSD does not yet
>> >> >> support this configuration. See [insert SSSD bug number] for more
>> >> >> information."
>> >> >
>> >> >I would also prefer to log into syslog/journal via sss_log() in this
>> >> >case, to get admin's attention easily.
>> >> It would be supperfluos.
>> >> We will fail and there should be log message
>> >>             sss_log_ext(SSS_LOG_WARNING, LOG_AUTHPRIV, "Warning: user would " \
>> >>                         "have been denied GPO-based logon access if the " \
>> >>                         "ad_gpo_access_control option were set to enforcing " \
>> >>                         "mode.");
>> >> 
>> >
>> >Would this message also appear in enforcing mode? Remember there is
>> >still Stephen's patch on the list to switch the default to enforcing.
>> >
>> >Also, the message really doesn't tell anything about the cause of the
>> >denial.
>> User will be able to authenticate in permissive mode and we will write message
>> to syslog. If administrator is interested then it will enable debugging in sssd
>> and investigate issue. In this case syslog message make sense.
>> 
>> In enforcing mode, user will not be able to authenticate and administrator will
>> have to investigate issue anyway. So there is not reason for syslog message.
>          ~~~~~~~~~~~~~~~~~~~~~~~
>this would be easier with a syslog message.
It would be even more easier with messages with log levels <=2 in journald.

I'm sorry you still do not have a valid reason for explicit message in syslog.

We have many cases when syslog message would simplify troubleshooting.
So it's better to do it right way instead of copy&paste style.

I will send new patch with Stephen's suggestion.

LS



More information about the sssd-devel mailing list