[SSSD-users] sssd-ad GPO not working
Koen de Boeve
koen at galaxystudios.com
Fri Jan 23 20:57:05 UTC 2015
Hi Jacub,
> Hi Koen, I don't have a complete answer, but I'll try to help and
> maybe we can work out some details. First, do you have an actual AD
> server around to test with? In the past we've seen bugs with Samba
> that didn't occur with AD and I'm not sure if anyone tried the GPO
> integration with Samba.. The SSSD version you're running is pretty
> recent, the only GPO-related bug after the 1.12.3 release was
> https://fedorahosted.org/sssd/ticket/2543
Pretty sure it has nothing to do with unresolvable LDAP uri :-)
I don't have a Windows AD, but I can definitely try to set up one on our
test environment.
But that s gonna take some time.
>
> I would advice against enumerate=True in large environments.
We dont have a large environment, and I put it there, on purpose, to see
if it worked :-)
Once I have everything working as it should I will revise the settings
before I deploy it on all our linux machines.
>
> You can drop ldap_schema=ad, it's already the default for id_provider=ad
OK good to know, thanks for that !
>
> Can you confirm that the GUIDs of the GPOs SSSD downloads correspond to
> those you defined on the sever side?
[root at pdc Policies]# ls
{31B2F340-016D-11D2-945F-00C04FB984F9} - This is the Default Policy (
empty )
{691A69C9-FEF3-4A42-8129-64E8741F9D2C} - Other Policy, not for this OU
{6AC1786C-016F-11D2-945F-00C04FB984F9} - Same
{D49E3752-2ECB-42F6-A418-2AE1F3092929} - This is the Policy containing
the deny rules for user Testuser (Deny log on locally and Deny log on
through Remote Desktop )
{E55C6360-FBC1-485A-8EFF-A7D9392514D2} - Other Policy, not for this OU
> Note that func_versions is 2 and flags is 0, same for the other GPO.
What does that mean? :-)
>
> OK, access was denied but since both the flags and the func_version were
> value we expect, I presume the code made it all the way to
> ad_gpo_evaluate_ace() where the GPO is really evaluated. Unfortunately
> there's not much logging there. I wonder if the GUIDs are correct? If
> so, we can proceed with debugging, maybe with some instrumented build..
There is one SID I cant figure out: [ad_gpo_parse_machine_ext_names]
(0x4000): gpo_cse_guids[0] is {827D319E-6EAC-11D2-A4EA-00C04F79F83A}
btw did you also try the other way around, only allow access?
Yes, same issue
Regards and thanks for the help!, Koen
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20150123/b79d6ff0/attachment.html>
More information about the sssd-users
mailing list