On Fri, Dec 10, 2010 at 02:21:40PM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 12/10/2010 06:34 AM, Sumit Bose wrote:
> On Thu, Dec 09, 2010 at 10:20:09AM -0500, Stephen Gallagher wrote:
> This patch adds simple_allow_groups and simple_deny_groups options
> to the simple access provider. It makes it possible to grant or
> deny access based on a user's group memberships within the domain.
>
> This patch makes one minor change to previous functionality: now
> all deny rules will supersede allow rules. Previously, if both
> simple_allow_users and simple_deny_users were set with the same
> value, the allow would win.
>
> Fixes
https://fedorahosted.org/sssd/ticket/440
+
+ /* Construct a list of the user's groups */
+ for (i = 0; i < msg->num_elements; i++) {
+ if (strcasecmp(msg->elements[i].name, SYSDB_MEMBEROF) == 0) {
> If there is no SYSDB_MEMBEROF groups and j might be undefined later on.
> Why do you run the loop yourself instead of using ldb_msg_find_element() ?
Because I glanced at all of the other ldb_msg_find_* functions and saw
that they said "Assumes that elements are single valued", so I
reimplemented it. I've switched to using ldb_msg_find_element() now.
Good catch, by the way. I didn't think about the case where the user has
no groups but the primary.
New patch attached.
ACK.
While testing this patch it came to my mind that it would be nice to see
a higher level debug message explaining why the access was denied. But
this can be easily done in a different patch.
bye,
Sumit
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAk0CfcMACgkQeiVVYja6o6O6EACgocA2AF6kJJ2nNvpBXC1a7VPp
6M4AoIENoVqW6A40JGJwDfX4mcTe+D3n
=ohMT
-----END PGP SIGNATURE-----