SSSD] [PATCH] AD: Add support for gpo permissive mode

[Yassir Elley]

Hi,

The attached patch adds support for gpo permissive mode. Specifically, if the ad_gpo_access_control option is set to "permissive" (which it is by default), and the gpo-based access control evaluation indicates that the user is denied access, then a syslog message is emitted indicating that the user would have been denied logon access if the option were set to "enforcing".

In order to simplify sending syslog messages to the security log (with or without journald), I have introduced a generic sss_log_ext function, which can be used with any syslog facility (including our standard "LOG_DAEMON" facility, as well as the security log "LOG_AUTHPRIV" facility).

This patch depends on a previously submitted patch ("Add initial gpo-smb implementation"), which has not yet been pushed to master.

Regards,
Yassir.

[Sumit Bose]

On Fri, May 30, 2014 at 08:52:41AM -0400, Yassir Elley wrote:
> Hi,
>
> The attached patch adds support for gpo permissive mode. Specifically, if the ad_gpo_access_control option is set to "permissive" (which it is by default), and the gpo-based access control evaluation indicates that the user is denied access, then a syslog message is emitted indicating that the user would have been denied logon access if the option were set to "enforcing".
>
> In order to simplify sending syslog messages to the security log (with or without journald), I have introduced a generic sss_log_ext function, which can be used with any syslog facility (including our standard "LOG_DAEMON" facility, as well as the security log "LOG_AUTHPRIV" facility).
>
> This patch depends on a previously submitted patch ("Add initial gpo-smb implementation"), which has not yet been pushed to master.

Can you rebase this patch on top of the latest version of "Add initial
gpo-smb implementation"?

bye,
Sumit
> Regards,
> Yassir.

[Yassir Elley]

----- Original Message -----
> On Fri, May 30, 2014 at 08:52:41AM -0400, Yassir Elley wrote:
> > Hi,
> >
> > The attached patch adds support for gpo permissive mode. Specifically, if
> > the ad_gpo_access_control option is set to "permissive" (which it is by
> > default), and the gpo-based access control evaluation indicates that the
> > user is denied access, then a syslog message is emitted indicating that
> > the user would have been denied logon access if the option were set to
> > "enforcing".
> >
> > In order to simplify sending syslog messages to the security log (with or
> > without journald), I have introduced a generic sss_log_ext function, which
> > can be used with any syslog facility (including our standard "LOG_DAEMON"
> > facility, as well as the security log "LOG_AUTHPRIV" facility).
> >
> > This patch depends on a previously submitted patch ("Add initial gpo-smb
> > implementation"), which has not yet been pushed to master.
>
> Can you rebase this patch on top of the latest version of "Add initial
> gpo-smb implementation"?
>
> bye,
> Sumit
> >

Rebased patch attached.

Regards,
Yassir.

[Sumit Bose]

On Sat, Jun 28, 2014 at 01:51:41AM -0400, Yassir Elley wrote:
> ----- Original Message -----
> > On Fri, May 30, 2014 at 08:52:41AM -0400, Yassir Elley wrote:
> > > Hi,
> > >
> > > The attached patch adds support for gpo permissive mode. Specifically, if
> > > the ad_gpo_access_control option is set to "permissive" (which it is by
> > > default), and the gpo-based access control evaluation indicates that the
> > > user is denied access, then a syslog message is emitted indicating that
> > > the user would have been denied logon access if the option were set to
> > > "enforcing".
> > >
> > > In order to simplify sending syslog messages to the security log (with or
> > > without journald), I have introduced a generic sss_log_ext function, which
> > > can be used with any syslog facility (including our standard "LOG_DAEMON"
> > > facility, as well as the security log "LOG_AUTHPRIV" facility).
> > >
> > > This patch depends on a previously submitted patch ("Add initial gpo-smb
> > > implementation"), which has not yet been pushed to master.
> >
> > Can you rebase this patch on top of the latest version of "Add initial
> > gpo-smb implementation"?
> >
> > bye,
> > Sumit
> > >
>
> Rebased patch attached.

Permissive mode is working as expected. ACK.

bye,
Sumit
> Regards,
> Yassir.

[Jakub Hrozek]

On Mon, Jun 30, 2014 at 06:04:43PM +0200, Sumit Bose wrote:
> On Sat, Jun 28, 2014 at 01:51:41AM -0400, Yassir Elley wrote:
> > ----- Original Message -----
> > > On Fri, May 30, 2014 at 08:52:41AM -0400, Yassir Elley wrote:
> > > > Hi,
> > > >
> > > > The attached patch adds support for gpo permissive mode. Specifically, if
> > > > the ad_gpo_access_control option is set to "permissive" (which it is by
> > > > default), and the gpo-based access control evaluation indicates that the
> > > > user is denied access, then a syslog message is emitted indicating that
> > > > the user would have been denied logon access if the option were set to
> > > > "enforcing".
> > > >
> > > > In order to simplify sending syslog messages to the security log (with or
> > > > without journald), I have introduced a generic sss_log_ext function, which
> > > > can be used with any syslog facility (including our standard "LOG_DAEMON"
> > > > facility, as well as the security log "LOG_AUTHPRIV" facility).
> > > >
> > > > This patch depends on a previously submitted patch ("Add initial gpo-smb
> > > > implementation"), which has not yet been pushed to master.
> > >
> > > Can you rebase this patch on top of the latest version of "Add initial
> > > gpo-smb implementation"?
> > >
> > > bye,
> > > Sumit
> > > >
> >
> > Rebased patch attached.
>
> Permissive mode is working as expected. ACK.
>
> bye,
> Sumit

Pushed to master:
    588f8fbe74e66cc015f185a5b798173d320a65b5