On Mon, Apr 27, 2015 at 03:05:32PM +0200, Pavel Reichl wrote:
@@ -772,9 +776,11 @@ static void simple_access_check_done(struct tevent_req *subreq) struct simple_access_check_state *state = tevent_req_data(req, struct simple_access_check_state); errno_t ret;
bool failed_to_resolve_group;
/* We know the names now. Run the check. */
- ret = simple_check_get_groups_recv(subreq, state, &state->group_names);
- ret = simple_check_get_groups_recv(subreq, state, &state->group_names,
talloc_zfree(subreq); if (ret == ENOENT) { /* If the user wasn't found, just shortcut */&failed_to_resolve_group);
@@ -786,6 +792,18 @@ static void simple_access_check_done(struct tevent_req *subreq) "Could not collect groups of user %s\n", state->username); tevent_req_error(req, ret); return;
- } else if (ret == EOK && failed_to_resolve_group) {
This one looks good, but this change also got me wondering -- why change the simple_check_get_groups_ request at all and not just return a separate error code? ERR_SIMPLE_GROUPS_MISSING instead of branching on EOK and another boolean?
DEBUG(SSSDBG_OP_FAILURE,
"Could not collect groups of user %s\n", state->username);
if (state->ctx->deny_groups == NULL) {
DEBUG(SSSDBG_TRACE_FUNC,
"But no deny groups were defined so we can continue.\n");
} else {
DEBUG(SSSDBG_OP_FAILURE,
"Some deny groups were defined, we can't continue\n");
tevent_req_error(req, ret);
return;
}
}
ret = simple_check_groups(state->ctx, state->group_names,
-- 2.1.0