root/openPolicies/README @ 2

Open Policies is a small library of functions that manipulate Linux user profile configurations, including those related to GNOME and Firefox as well as the available printers and samba shares mounted during login. These functions can be integrated in scripts that are used to enforce certain configurations on login. Those enforced configurations are called "policies".

The functions present in this library are meant to be stored centrally (eg: on a read-only samba share) and sourced from shell scripts that are specific to users and / or groups. Those scripts should also be stored centrally and executed automatically from the Linux desktops using, for example, the pam_script module. This way, if centralized authentication (via LDAP, Active Directory, etc) is in place, it is possible to enforce login based configurations (ie, policies) depending on the user and the groups the user belongs to. Such configurations can then easily be managed from a central location.

Implementation details depend on the Linux distribution and implementer preferences. However, we suggest:

- storing the functions on a directory named COMMON inside a samba share
- storing the user scripts on a directory called USERS inside the same samba share
- storing the group scripts on a directory called GROUPS inside the same samba share
- storing a global script named global.sh inside the samba share, at the top level

During the login process the Linux desktop should

- mount the samba share that hosts the functions and the scripts
- execute global.sh for all users
- determine all groups the user belongs to and execute the corresponding

GROUPS/<groupname>.sh

scripts whenever they exist

- look for 

USERS/<username>.sh 

and execute it if it exists.

This execution sequence allows for group specific configurations to override global configurations, and user specific configurations to override both.

During the logout process the mounted shares should be unmounted and the added printers (if any) should be removed.

Several usage examples are availble in the EXAMPLES file.