>From 5cd394977606d2bcba06ce07fc0f05d01eab7940 Mon Sep 17 00:00:00 2001 From: eindenbom Date: Fri, 2 Jul 2010 19:01:57 +0400 Subject: [PATCH 10/12] Use new LDAP connection framework in IPA access backend. --- src/providers/ipa/ipa_access.c | 440 +++++++++++++++++++--------------------- src/providers/ipa/ipa_access.h | 2 +- src/providers/ipa/ipa_init.c | 6 +- 3 files changed, 215 insertions(+), 233 deletions(-) diff --git a/src/providers/ipa/ipa_access.c b/src/providers/ipa/ipa_access.c index 3d66c16..6771bd9 100644 --- a/src/providers/ipa/ipa_access.c +++ b/src/providers/ipa/ipa_access.c @@ -159,12 +159,16 @@ static errno_t hbac_sysdb_data_recv(TALLOC_CTX *mem_ctx, return EOK; } -static void ipa_access_reply(struct be_req *be_req, int pam_status) +static void ipa_access_reply(struct hbac_ctx *hbac_ctx, int pam_status) { + struct be_req *be_req = hbac_ctx->be_req; struct pam_data *pd; pd = talloc_get_type(be_req->req_data, struct pam_data); pd->pam_status = pam_status; + /* destroy HBAC context now to release all used resources and LDAP connection */ + talloc_zfree(hbac_ctx); + if (pam_status == PAM_SUCCESS || pam_status == PAM_PERM_DENIED) { be_req->fn(be_req, DP_ERR_OK, pam_status, NULL); } else { @@ -175,6 +179,7 @@ static void ipa_access_reply(struct be_req *be_req, int pam_status) struct hbac_get_service_data_state { struct tevent_context *ev; struct sdap_id_ctx *sdap_ctx; + struct sdap_id_op *sdap_op; struct sysdb_ctx *sysdb; struct sysdb_handle *handle; const char *basedn; @@ -189,19 +194,19 @@ struct hbac_get_service_data_state { size_t current_item; }; -static void hbac_get_services_connect_done(struct tevent_req *subreq); static void hbac_services_get_done(struct tevent_req *subreq); struct tevent_req *hbac_get_service_data_send(TALLOC_CTX *memctx, struct tevent_context *ev, - bool offline, - struct sdap_id_ctx *sdap_ctx, - struct sysdb_ctx *sysdb, - const char *basedn) + struct sdap_id_ctx *sdap_ctx, + struct sdap_id_op *sdap_op, + struct sysdb_ctx *sysdb, + const char *basedn) { struct tevent_req *req = NULL; struct tevent_req *subreq = NULL; struct hbac_get_service_data_state *state; + struct sdap_handle *sdap_handle; int ret; req = tevent_req_create(memctx, &state, struct hbac_get_service_data_state); @@ -211,8 +216,8 @@ struct tevent_req *hbac_get_service_data_send(TALLOC_CTX *memctx, } state->ev = ev; - state->offline = offline; state->sdap_ctx = sdap_ctx; + state->sdap_op = sdap_op; state->sysdb = sysdb; state->handle = NULL; state->basedn = basedn; @@ -253,7 +258,7 @@ struct tevent_req *hbac_get_service_data_send(TALLOC_CTX *memctx, DEBUG(9, ("Services filter: [%s].\n", state->services_filter)); - if (offline) { + if (!state->sdap_op) { ret = hbac_sysdb_data_recv(state, state->sysdb, state->sdap_ctx->be->domain, state->services_filter, HBAC_SERVICES_SUBDIR, @@ -270,23 +275,15 @@ struct tevent_req *hbac_get_service_data_send(TALLOC_CTX *memctx, return req; } - if (sdap_ctx->gsh == NULL || ! sdap_ctx->gsh->connected) { - subreq = sdap_cli_connect_send(state, ev, sdap_ctx->opts, - sdap_ctx->be, sdap_ctx->service, NULL); - if (!subreq) { - DEBUG(1, ("sdap_cli_connect_send failed.\n")); - ret = ENOMEM; - goto fail; - } - - tevent_req_set_callback(subreq, hbac_get_services_connect_done, req); - - return req; + sdap_handle = sdap_id_op_handle(state->sdap_op); + if (sdap_handle == NULL) { + DEBUG(1, ("Bug: sdap_id_op is disconnected.\n")); + ret = EIO; + goto fail; } - subreq = sdap_get_generic_send(state, state->ev, state->sdap_ctx->opts, - state->sdap_ctx->gsh, + sdap_handle, state->services_search_base, LDAP_SCOPE_SUB, state->services_filter, @@ -309,45 +306,6 @@ fail: return req; } -static void hbac_get_services_connect_done(struct tevent_req *subreq) -{ - struct tevent_req *req = tevent_req_callback_data(subreq, - struct tevent_req); - struct hbac_get_service_data_state *state = tevent_req_data(req, - struct hbac_get_service_data_state); - int ret; - - ret = sdap_cli_connect_recv(subreq, state->sdap_ctx, &state->sdap_ctx->gsh, - NULL); - talloc_zfree(subreq); - if (ret) { - tevent_req_error(req, ret); - return; - } - - subreq = sdap_get_generic_send(state, state->ev, - state->sdap_ctx->opts, - state->sdap_ctx->gsh, - state->services_search_base, - LDAP_SCOPE_SUB, - state->services_filter, - state->services_attrs, - NULL, 0); - - if (subreq == NULL) { - DEBUG(1, ("sdap_get_generic_send failed.\n")); - ret = ENOMEM; - goto fail; - } - - tevent_req_set_callback(subreq, hbac_services_get_done, req); - return; - -fail: - tevent_req_error(req, ret); - return; -} - static void hbac_services_get_done(struct tevent_req *subreq) { struct tevent_req *req = tevent_req_callback_data(subreq, @@ -575,8 +533,8 @@ fail: struct hbac_get_host_info_state { struct tevent_context *ev; struct sdap_id_ctx *sdap_ctx; + struct sdap_id_op *sdap_op; struct sysdb_ctx *sysdb; - bool offline; char *host_filter; char *host_search_base; @@ -588,14 +546,13 @@ struct hbac_get_host_info_state { struct hbac_host_info **hbac_host_info; }; -static void hbac_get_host_info_connect_done(struct tevent_req *subreq); -static void hbac_get_host_memberof(struct tevent_req *req); +static void hbac_get_host_memberof(struct tevent_req *req, bool offline); static void hbac_get_host_memberof_done(struct tevent_req *subreq); static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx, struct tevent_context *ev, - bool offline, struct sdap_id_ctx *sdap_ctx, + struct sdap_id_op *sdap_op, struct sysdb_ctx *sysdb, const char *basedn, const char **hostnames) @@ -603,6 +560,7 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx, struct tevent_req *req = NULL; struct tevent_req *subreq = NULL; struct hbac_get_host_info_state *state; + struct sdap_handle *sdap_handle; int ret; int i; @@ -619,8 +577,8 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx, state->ev = ev; state->sdap_ctx = sdap_ctx; + state->sdap_op = sdap_op; state->sysdb = sysdb; - state->offline = offline; state->host_reply_list = NULL; state->host_reply_count = 0; @@ -671,7 +629,7 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx, state->host_attrs[5] = SYSDB_ORIG_MEMBEROF; state->host_attrs[6] = NULL; - if (offline) { + if (!state->sdap_op) { ret = hbac_sysdb_data_recv(state, state->sysdb, state->sdap_ctx->be->domain, state->host_filter, HBAC_HOSTS_SUBDIR, @@ -682,28 +640,20 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx, DEBUG(1, ("hbac_sysdb_data_recv failed.\n")); goto fail; } - hbac_get_host_memberof(req); + hbac_get_host_memberof(req, true); tevent_req_post(req, ev); return req; } - if (sdap_ctx->gsh == NULL || ! sdap_ctx->gsh->connected) { - subreq = sdap_cli_connect_send(state, ev, sdap_ctx->opts, - sdap_ctx->be, sdap_ctx->service, NULL); - if (!subreq) { - DEBUG(1, ("sdap_cli_connect_send failed.\n")); - ret = ENOMEM; - goto fail; - } - - tevent_req_set_callback(subreq, hbac_get_host_info_connect_done, req); - - return req; + sdap_handle = sdap_id_op_handle(state->sdap_op); + if (sdap_handle == NULL) { + DEBUG(1, ("Bug: sdap_id_op is disconnected.\n")); + ret = EIO; + goto fail; } - subreq = sdap_get_generic_send(state, state->ev, state->sdap_ctx->opts, - state->sdap_ctx->gsh, + sdap_handle, state->host_search_base, LDAP_SCOPE_SUB, state->host_filter, @@ -726,46 +676,6 @@ fail: return req; } -static void hbac_get_host_info_connect_done(struct tevent_req *subreq) -{ - struct tevent_req *req = tevent_req_callback_data(subreq, - struct tevent_req); - struct hbac_get_host_info_state *state = tevent_req_data(req, - struct hbac_get_host_info_state); - int ret; - - ret = sdap_cli_connect_recv(subreq, state->sdap_ctx, &state->sdap_ctx->gsh, - NULL); - talloc_zfree(subreq); - if (ret) { - tevent_req_error(req, ret); - return; - } - - subreq = sdap_get_generic_send(state, state->ev, - state->sdap_ctx->opts, - state->sdap_ctx->gsh, - state->host_search_base, - LDAP_SCOPE_SUB, - state->host_filter, - state->host_attrs, - NULL, 0); - - if (subreq == NULL) { - DEBUG(1, ("sdap_get_generic_send failed.\n")); - ret = ENOMEM; - goto fail; - } - - tevent_req_set_callback(subreq, hbac_get_host_memberof_done, req); - - return; - -fail: - tevent_req_error(req, ret); - return; -} - static void hbac_get_host_memberof_done(struct tevent_req *subreq) { struct tevent_req *req = tevent_req_callback_data(subreq, @@ -782,10 +692,10 @@ static void hbac_get_host_memberof_done(struct tevent_req *subreq) return; } - hbac_get_host_memberof(req); + hbac_get_host_memberof(req, false); } -static void hbac_get_host_memberof(struct tevent_req *req) +static void hbac_get_host_memberof(struct tevent_req *req, bool offline) { struct hbac_get_host_info_state *state = tevent_req_data(req, struct hbac_get_host_info_state); @@ -875,8 +785,8 @@ static void hbac_get_host_memberof(struct tevent_req *req) } ret = sysdb_attrs_get_string_array(state->host_reply_list[i], - state->offline ? SYSDB_ORIG_MEMBEROF : - IPA_MEMBEROF, + offline ? SYSDB_ORIG_MEMBEROF : + IPA_MEMBEROF, hhi, &(hhi[i]->memberof)); if (ret != EOK) { if (ret != ENOENT) { @@ -896,7 +806,7 @@ static void hbac_get_host_memberof(struct tevent_req *req) state->hbac_host_info = hhi; - if (state->offline) { + if (offline) { tevent_req_done(req); return; } @@ -974,8 +884,8 @@ static int hbac_get_host_info_recv(struct tevent_req *req, TALLOC_CTX *memctx, struct hbac_get_rules_state { struct tevent_context *ev; struct sdap_id_ctx *sdap_ctx; + struct sdap_id_op *sdap_op; struct sysdb_ctx *sysdb; - bool offline; const char *host_dn; const char **memberof; @@ -989,14 +899,13 @@ struct hbac_get_rules_state { int current_item; }; -static void hbac_get_rules_connect_done(struct tevent_req *subreq); -static void hbac_rule_get(struct tevent_req *req); +static void hbac_rule_get(struct tevent_req *req, bool offline); static void hbac_rule_get_done(struct tevent_req *subreq); static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx, struct tevent_context *ev, - bool offline, struct sdap_id_ctx *sdap_ctx, + struct sdap_id_op *sdap_op, struct sysdb_ctx *sysdb, const char *basedn, const char *host_dn, @@ -1005,6 +914,7 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx, struct tevent_req *req = NULL; struct tevent_req *subreq = NULL; struct hbac_get_rules_state *state; + struct sdap_handle *sdap_handle; int ret; int i; @@ -1020,8 +930,8 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx, } state->ev = ev; - state->offline = offline; state->sdap_ctx = sdap_ctx; + state->sdap_op = sdap_op; state->sysdb = sysdb; state->host_dn = host_dn; state->memberof = memberof; @@ -1091,7 +1001,7 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx, DEBUG(9, ("HBAC rule filter: [%s].\n", state->hbac_filter)); - if (offline) { + if (!state->sdap_op) { ret = hbac_sysdb_data_recv(state, state->sysdb, state->sdap_ctx->be->domain, state->hbac_filter, HBAC_RULES_SUBDIR, @@ -1102,28 +1012,20 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx, DEBUG(1, ("hbac_sysdb_data_recv failed.\n")); goto fail; } - hbac_rule_get(req); + hbac_rule_get(req, true); tevent_req_post(req, ev); return req; } - if (sdap_ctx->gsh == NULL || ! sdap_ctx->gsh->connected) { - subreq = sdap_cli_connect_send(state, ev, sdap_ctx->opts, - sdap_ctx->be, sdap_ctx->service, NULL); - if (!subreq) { - DEBUG(1, ("sdap_cli_connect_send failed.\n")); - ret = ENOMEM; - goto fail; - } - - tevent_req_set_callback(subreq, hbac_get_rules_connect_done, req); - - return req; + sdap_handle = sdap_id_op_handle(state->sdap_op); + if (sdap_handle == NULL) { + DEBUG(1, ("Bug: sdap_id_op is disconnected.\n")); + ret = EIO; + goto fail; } - subreq = sdap_get_generic_send(state, state->ev, state->sdap_ctx->opts, - state->sdap_ctx->gsh, + sdap_handle, state->hbac_search_base, LDAP_SCOPE_SUB, state->hbac_filter, @@ -1146,45 +1048,6 @@ fail: return req; } -static void hbac_get_rules_connect_done(struct tevent_req *subreq) -{ - struct tevent_req *req = tevent_req_callback_data(subreq, - struct tevent_req); - struct hbac_get_rules_state *state = tevent_req_data(req, - struct hbac_get_rules_state); - int ret; - - ret = sdap_cli_connect_recv(subreq, state->sdap_ctx, &state->sdap_ctx->gsh, - NULL); - talloc_zfree(subreq); - if (ret) { - tevent_req_error(req, ret); - return; - } - - subreq = sdap_get_generic_send(state, state->ev, - state->sdap_ctx->opts, - state->sdap_ctx->gsh, - state->hbac_search_base, - LDAP_SCOPE_SUB, - state->hbac_filter, - state->hbac_attrs, - NULL, 0); - - if (subreq == NULL) { - DEBUG(1, ("sdap_get_generic_send failed.\n")); - ret = ENOMEM; - goto fail; - } - - tevent_req_set_callback(subreq, hbac_rule_get_done, req); - return; - -fail: - tevent_req_error(req, ret); - return; -} - static void hbac_rule_get_done(struct tevent_req *subreq) { struct tevent_req *req = tevent_req_callback_data(subreq, @@ -1201,10 +1064,10 @@ static void hbac_rule_get_done(struct tevent_req *subreq) return; } - hbac_rule_get(req); + hbac_rule_get(req, false); } -static void hbac_rule_get(struct tevent_req *req) +static void hbac_rule_get(struct tevent_req *req, bool offline) { struct hbac_get_rules_state *state = tevent_req_data(req, struct hbac_get_rules_state); @@ -1229,7 +1092,7 @@ static void hbac_rule_get(struct tevent_req *req) DEBUG(9, ("OriginalDN: [%s].\n", (const char *)el->values[0].data)); } - if (state->hbac_reply_count == 0 || state->offline) { + if (state->hbac_reply_count == 0 || offline) { tevent_req_done(req); return; } @@ -1311,15 +1174,13 @@ static int hbac_get_rules_recv(struct tevent_req *req, TALLOC_CTX *memctx, { struct hbac_get_rules_state *state = tevent_req_data(req, struct hbac_get_rules_state); - int i; TEVENT_REQ_RETURN_ON_ERROR(req); *hbac_rule_count = state->hbac_reply_count; *hbac_rule_list = talloc_steal(memctx, state->hbac_reply_list); - for (i = 0; i < state->hbac_reply_count; i++) { - talloc_steal(memctx, state->hbac_reply_list[i]); - } + /* we do not need to steal each hbac_reply_list[i] + * as it belongs to hbac_reply_list memory block */ return EOK; } @@ -1817,18 +1678,22 @@ static int evaluate_ipa_hbac_rules(struct hbac_ctx *hbac_ctx, return EOK; } +static int hbac_retry(struct hbac_ctx *hbac_ctx); +static void hbac_connect_done(struct tevent_req *subreq); +static bool hbac_check_step_result(struct hbac_ctx *hbac_ctx, int ret); + +static int hbac_get_host_info_step(struct hbac_ctx *hbac_ctx); static void hbac_get_host_info_done(struct tevent_req *req); static void hbac_get_rules_done(struct tevent_req *req); static void hbac_get_service_data_done(struct tevent_req *req); void ipa_access_handler(struct be_req *be_req) { - struct tevent_req *req; struct pam_data *pd; struct hbac_ctx *hbac_ctx; int pam_status = PAM_SYSTEM_ERR; struct ipa_access_ctx *ipa_access_ctx; - const char *hostlist[3]; + bool offline; int ret; pd = talloc_get_type(be_req->req_data, struct pam_data); @@ -1853,43 +1718,141 @@ void ipa_access_handler(struct be_req *be_req) DEBUG(1, ("domain_to_basedn failed.\n")); goto fail; } - hbac_ctx->offline = be_is_offline(be_req->be_ctx); - DEBUG(9, ("Connection status is [%s].\n", hbac_ctx->offline ? "offline" : - "online")); + offline = be_is_offline(be_req->be_ctx); + DEBUG(9, ("Connection status is [%s].\n", offline ? "offline" : "online")); + if (!offline) { + hbac_ctx->sdap_op = sdap_id_op_create(hbac_ctx, hbac_ctx->sdap_ctx->conn_cache); + if (!hbac_ctx->sdap_op) { + DEBUG(1, ("sdap_id_op_create failed.\n")); + goto fail; + } + } + + ret = hbac_retry(hbac_ctx); + if (ret != EOK) { + goto fail; + } + + return; + +fail: + ipa_access_reply(hbac_ctx, pam_status); +} + +static int hbac_retry(struct hbac_ctx *hbac_ctx) +{ + struct tevent_req *subreq; + int ret; + + if (!hbac_ctx->sdap_op) { + return hbac_get_host_info_step(hbac_ctx); + } + + subreq = sdap_id_op_connect_send(hbac_ctx->sdap_op, hbac_ctx, &ret); + if (!subreq) { + DEBUG(1, ("sdap_id_op_connect_send failed: %d(%s).\n", ret, strerror(ret))); + return ret; + } + + tevent_req_set_callback(subreq, hbac_connect_done, hbac_ctx); + return EOK; +} + +static void hbac_connect_done(struct tevent_req *subreq) +{ + struct hbac_ctx *hbac_ctx = tevent_req_callback_data(subreq, struct hbac_ctx); + int ret, dp_error; + + ret = sdap_id_op_connect_recv(subreq, &dp_error); + talloc_zfree(subreq); + + if (dp_error == DP_ERR_OFFLINE) { + /* switching to offline mode */ + talloc_zfree(hbac_ctx->sdap_op); + } else if (ret != EOK) { + goto fail; + } + + ret = hbac_get_host_info_step(hbac_ctx); + if (ret != EOK) { + goto fail; + } + + return; + +fail: + ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR); +} + +/* Check the step result code and continue, retry, get offline result or abort accordingly */ +static bool hbac_check_step_result(struct hbac_ctx *hbac_ctx, int ret) +{ + int dp_error; + + if (ret == EOK) { + return true; + } + + if (!hbac_ctx->sdap_op) { + /* already offline => the error is fatal */ + ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR); + return false; + } + + ret = sdap_id_op_done(hbac_ctx->sdap_op, ret, &dp_error); + if (dp_error == DP_ERR_OFFLINE) { + /* switching to offline mode */ + talloc_zfree(hbac_ctx->sdap_op); + dp_error = DP_ERR_OK; + } + + if (dp_error == DP_ERR_OK) { + /* retry */ + ret = hbac_retry(hbac_ctx); + if (ret == EOK) { + return false; + } + + dp_error = DP_ERR_FATAL; + } + + ipa_access_reply(hbac_ctx, PAM_SYSTEM_ERR); + return false; +} + +static int hbac_get_host_info_step(struct hbac_ctx *hbac_ctx) +{ + struct be_ctx *be_ctx = hbac_ctx->be_req->be_ctx; + struct pam_data *pd = hbac_ctx->pd; + const char *hostlist[3]; + struct tevent_req *subreq; hostlist[0] = dp_opt_get_cstring(hbac_ctx->ipa_options, IPA_HOSTNAME); if (hostlist[0] == NULL) { DEBUG(1, ("ipa_hostname not available.\n")); - goto fail; + return EINVAL; } if (pd->rhost != NULL && *pd->rhost != '\0') { hostlist[1] = pd->rhost; + hostlist[2] = NULL; } else { hostlist[1] = NULL; - pd->rhost = dp_opt_get_string(hbac_ctx->ipa_options, IPA_HOSTNAME); - if (pd->rhost == NULL) { - DEBUG(1, ("ipa_hostname not available.\n")); - goto fail; - } + pd->rhost = discard_const_p(char, hostlist[0]); } - hostlist[2] = NULL; - req = hbac_get_host_info_send(hbac_ctx, be_req->be_ctx->ev, - hbac_ctx->offline, hbac_ctx->sdap_ctx, - be_req->be_ctx->sysdb, hbac_ctx->ldap_basedn, - hostlist); - if (req == NULL) { + subreq = hbac_get_host_info_send(hbac_ctx, be_ctx->ev, + hbac_ctx->sdap_ctx, hbac_ctx->sdap_op, + be_ctx->sysdb, hbac_ctx->ldap_basedn, + hostlist); + if (!subreq) { DEBUG(1, ("hbac_get_host_info_send failed.\n")); - goto fail; + return ENOMEM; } - tevent_req_set_callback(req, hbac_get_host_info_done, hbac_ctx); - return; - -fail: - ipa_access_reply(be_req, pam_status); + tevent_req_set_callback(subreq, hbac_get_host_info_done, hbac_ctx); + return EOK; } static void hbac_get_host_info_done(struct tevent_req *req) @@ -1902,10 +1865,12 @@ static void hbac_get_host_info_done(struct tevent_req *req) struct hbac_host_info *local_hhi = NULL; int i; + talloc_zfree(hbac_ctx->hbac_host_info); ret = hbac_get_host_info_recv(req, hbac_ctx, &hbac_ctx->hbac_host_info); talloc_zfree(req); - if (ret != EOK) { - goto fail; + + if (!hbac_check_step_result(hbac_ctx, ret)) { + return; } ipa_hostname = dp_opt_get_cstring(hbac_ctx->ipa_options, IPA_HOSTNAME); @@ -1935,8 +1900,9 @@ static void hbac_get_host_info_done(struct tevent_req *req) ret = EINVAL; goto fail; } - req = hbac_get_rules_send(hbac_ctx, be_req->be_ctx->ev, hbac_ctx->offline, - hbac_ctx->sdap_ctx, be_req->be_ctx->sysdb, + req = hbac_get_rules_send(hbac_ctx, be_req->be_ctx->ev, + hbac_ctx->sdap_ctx, hbac_ctx->sdap_op, + be_req->be_ctx->sysdb, hbac_ctx->ldap_basedn, local_hhi->dn, local_hhi->memberof); if (req == NULL) { @@ -1948,7 +1914,7 @@ static void hbac_get_host_info_done(struct tevent_req *req) return; fail: - ipa_access_reply(be_req, pam_status); + ipa_access_reply(hbac_ctx, pam_status); } static void hbac_get_rules_done(struct tevent_req *req) @@ -1958,15 +1924,19 @@ static void hbac_get_rules_done(struct tevent_req *req) int ret; int pam_status = PAM_SYSTEM_ERR; + hbac_ctx->hbac_rule_count = 0; + talloc_zfree(hbac_ctx->hbac_rule_list); + ret = hbac_get_rules_recv(req, hbac_ctx, &hbac_ctx->hbac_rule_count, &hbac_ctx->hbac_rule_list); talloc_zfree(req); - if (ret != EOK) { - goto failed; + + if (!hbac_check_step_result(hbac_ctx, ret)) { + return; } req = hbac_get_service_data_send(hbac_ctx, be_req->be_ctx->ev, - hbac_ctx->offline, hbac_ctx->sdap_ctx, + hbac_ctx->sdap_ctx, hbac_ctx->sdap_op, be_req->be_ctx->sysdb, hbac_ctx->ldap_basedn); if (req == NULL) { @@ -1978,7 +1948,7 @@ static void hbac_get_rules_done(struct tevent_req *req) return; failed: - ipa_access_reply(be_req, pam_status); + ipa_access_reply(hbac_ctx, pam_status); } static void hbac_get_service_data_done(struct tevent_req *req) @@ -1990,14 +1960,26 @@ static void hbac_get_service_data_done(struct tevent_req *req) int pam_status = PAM_SYSTEM_ERR; bool access_allowed = false; + hbac_ctx->hbac_services_count = 0; + talloc_zfree(hbac_ctx->hbac_services_list); + ret = hbac_get_service_data_recv(req, hbac_ctx, &hbac_ctx->hbac_services_count, &hbac_ctx->hbac_services_list); talloc_zfree(req); - if (ret != EOK) { - goto failed; + + if (!hbac_check_step_result(hbac_ctx, ret)) { + return; } + if (hbac_ctx->user_dn) { + talloc_free(discard_const_p(TALLOC_CTX, hbac_ctx->user_dn)); + hbac_ctx->user_dn = 0; + } + + hbac_ctx->groups_count = 0; + talloc_zfree(hbac_ctx->groups); + ret = hbac_get_user_info(hbac_ctx, be_req->be_ctx, pd->user, &hbac_ctx->user_dn, &hbac_ctx->groups_count, &hbac_ctx->groups); @@ -2020,5 +2002,5 @@ static void hbac_get_service_data_done(struct tevent_req *req) } failed: - ipa_access_reply(be_req, pam_status); + ipa_access_reply(hbac_ctx, pam_status); } diff --git a/src/providers/ipa/ipa_access.h b/src/providers/ipa/ipa_access.h index 514afc0..fc94d7a 100644 --- a/src/providers/ipa/ipa_access.h +++ b/src/providers/ipa/ipa_access.h @@ -47,6 +47,7 @@ struct ipa_access_ctx { struct hbac_ctx { struct sdap_id_ctx *sdap_ctx; + struct sdap_id_op *sdap_op; struct dp_option *ipa_options; struct time_rules_ctx *tr_ctx; struct be_req *be_req; @@ -58,7 +59,6 @@ struct hbac_ctx { const char *user_dn; size_t groups_count; const char **groups; - bool offline; char *ldap_basedn; struct sysdb_attrs **hbac_services_list; size_t hbac_services_count; diff --git a/src/providers/ipa/ipa_init.c b/src/providers/ipa/ipa_init.c index f3fa610..3eaa0a1 100644 --- a/src/providers/ipa/ipa_init.c +++ b/src/providers/ipa/ipa_init.c @@ -175,10 +175,10 @@ int sssm_ipa_id_init(struct be_ctx *bectx, goto done; } - ret = be_add_offline_cb(ctx, bectx, sdap_gsh_disconnect_callback, ctx, - NULL); + ret = sdap_id_conn_cache_create(ctx, ctx->be, + ctx->opts, ctx->service, + &ctx->conn_cache); if (ret != EOK) { - DEBUG(1, ("be_add_offline_cb failed.\n")); goto done; } -- 1.6.6.1