Bug 1462343

Summary: document information on why SSSD does not use host-based security filtering when processing AD GPOs
Product: Red Hat Enterprise Linux 7 Reporter: Striker Leggette <striker>
Component: sssdAssignee: Michal Zidek <mzidek>
Status: CLOSED ERRATA QA Contact: Dan Lavu <dlavu>
Severity: low Docs Contact:
Priority: low    
Version: 7.4CC: abokovoy, fidencio, grajaiya, jhrozek, lslebodn, mkosek, mzidek, pbrezina, rharwood, sbose, sgoveas, ssorce, tscherf
Target Milestone: rcFlags: striker: needinfo-
Target Release: 7.5   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: sssd-1.16.0-2.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-04-10 17:11:33 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Striker Leggette 2017-06-16 19:38:18 UTC 
[+] Description of problem:
 - At the moment, it is not possible to configure GPOs which apply to specific linux hosts without applying the GPO to an entire OU in which the linux host lives in.  It should be documented as to why this is not possible at this time so that users can be better informed.
Comment 3 Jakub Hrozek 2017-06-28 18:39:07 UTC 
Upstream ticket:
https://pagure.io/SSSD/sssd/issue/3444
Comment 4 Jakub Hrozek 2017-08-10 18:27:27 UTC 
To verify: Please check if sssd-ad contains a sufficient answer to comment #0.
Comment 6 Lukas Slebodnik 2017-10-27 14:26:35 UTC 
master:
* 6c1661d2f4e860d1b547d6188a4fe2bd564e87cf
Comment 8 Dan Lavu 2018-01-30 00:32:56 UTC 
Verified against sssd-1.16.0-14.el7.x86_64 

Man page contains the following. 

" NOTE: The current version of SSSD does not support host (computer) entries in the GPO 'Security Filtering' list. Only user and group entries are supported. Host entries in the list have no effect.
Comment 11 errata-xmlrpc 2018-04-10 17:11:33 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:0929