----- Original Message ----- > On 07/24/2014 01:44 PM, Yassir Elley wrote: > > Hi guys, > > > > With regard to adding support for gpo processing in offline mode, if we > > have gpo-guids and policy files cached from previous transactions, then we > > can simply retrieve all the gpo-guids from the cache, construct the policy > > file names, retrieve the policy files from the local GPO_CACHE directory, > > and perform the access checks. > > > > However, I have some questions: > > > > 1. If we don't have any gpo-guids or policy files cached from previous > > transactions, should gpo processing deny access by default (assuming that > > gpo_mode is enforcing)? > > If we don't have anything cached but some previous transaction was > successful (i.e. no policy was configured that time), I'd say we should > allow access.
We should probably behave in the same manner whether we are offline (and don't have any gpo-guids cached) or online (and no gpos were found to be applicable for the machine). Currently, in the online case, we are denying access by default (assuming gpo_mode is set to "enforcing"). In other words, if no GPOs are found, we deny access. I think this is a bug, b/c it is possible (though unlikely) that not a single gpo is applicable to the client machine. While there is such a thing as a Default Domain Policy GPO, it can be disabled (not a good idea, but possible). Do we agree that we should adopt a default Allow policy for both the offline and online cases described above? > > > 2. If we detect that we are off-line, at what points do we need to attempt > > to recover and perform offline processing (as opposed to simply returning > > an error). Certainly, we should perform offline processing if the initial > > ldap connect response (i.e. sdap_id_op_connect_recv) returns a dp_error of > > DP_ERR_OFFLINE. However, if one of the several ldap search responses (i.e. > > sdap_get_generic_recv) return a dp_error of DP_ERR_OFFLINE, should we > > still attempt to recover? Should we attempt to recover if the smb connect > > or smb read fails (in the gpo_child)? > > > > 3. If the initial ldap connection succeeds, but we go offline at a later > > point (and if the right thing to do is to attempt to recover at that > > point, per question 2), am I correct in assuming that we should discard > > any data received from the server up to then (if any), and behave as if we > > were offline since the connection started? The consensus on this seems to be that we should only perform offline gpo processing if the initial ldap_connect response fails with DP_ERR_OFFLINE. Yassir. _______________________________________________ sssd-devel mailing list [email protected] https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
