[sssd PR#5241][comment] GPO: respect ad_gpo_implicit_deny when evaluation rules

[sumit-bose]

URL: https://github.com/SSSD/sssd/pull/5241
Title: #5241: GPO: respect ad_gpo_implicit_deny when evaluation rules

sumit-bose commented:
"""
> Ah, ok. And shouldn't it work also the other way - if ad_gpo_implicit_deny = False and there is not explicit deny rule then allow access?

yes, but this should already work.

Here is an overview:

```
ad_gpo_implicit_deny = False (default)

- no allow-rules    no deny-rules present: all  users                    are allowed

- no allow-rules       deny-rules present: all  users not in deny-rules  are allowed

-    allow-rules    no deny-rules present: only users     in allow-rules are allowed

-    allow-rules       deny-rules present: only users     in allow-rules
                                                    and not in deny-rules  are allowed

ad_gpo_implicit_deny = True

- no allow-rules    no deny-rules present: no   users                    are allowed

- no allow-rules       deny-rules present: no   users                    are allowed

-    allow-rules    no deny-rules present: only users     in allow-rules are allowed

-    allow-rules       deny-rules present: only users     in allow-rules
                                                    and not in deny-rules  are allowed
```

This PR should make sure the `no allow-rules` cases of `ad_gpo_implicit_deny = True` work as expected.

HTH

bye,
Sumit
"""

See the full comment at https://github.com/SSSD/sssd/pull/5241#issuecomment-679046124