>From 1daec9096cc5ae8690b3fe567713cf9ef23096e7 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Mon, 7 Oct 2013 18:02:04 +0200 Subject: [PATCH 4/6] AD: Use the ad_access_filter if it's set Related: https://fedorahosted.org/sssd/ticket/2082 Currently the AD access control only checks if an account has been expired. This patch amends the logic so that if ad_access_filter is set, it is used automatically. --- src/providers/ad/ad_init.c | 22 ++++++++++++++++++++-- src/providers/ldap/ldap_common.c | 19 +++++++++++++++++++ src/providers/ldap/ldap_common.h | 3 +++ src/providers/ldap/ldap_init.c | 24 +++++++----------------- 4 files changed, 49 insertions(+), 19 deletions(-) diff --git a/src/providers/ad/ad_init.c b/src/providers/ad/ad_init.c index c829cc861a421db35b1e5f7a91941e20a3684ee6..d744c2a05cffa93a02a2c771ebd80725b0220a5b 100644 --- a/src/providers/ad/ad_init.c +++ b/src/providers/ad/ad_init.c @@ -366,6 +366,7 @@ sssm_ad_access_init(struct be_ctx *bectx, errno_t ret; struct ad_access_ctx *access_ctx; struct ad_id_ctx *ad_id_ctx; + const char *filter; access_ctx = talloc_zero(bectx, struct ad_access_ctx); if (!access_ctx) return ENOMEM; @@ -392,10 +393,27 @@ sssm_ad_access_init(struct be_ctx *bectx, ret = ENOMEM; goto fail; } - access_ctx->sdap_access_ctx->id_ctx = access_ctx->sdap_ctx; + + /* If ad_access_filter is set, the value of ldap_acess_order is + * expire, filter, otherwise only expire + */ access_ctx->sdap_access_ctx->access_rule[0] = LDAP_ACCESS_EXPIRE; - access_ctx->sdap_access_ctx->access_rule[1] = LDAP_ACCESS_EMPTY; + filter = dp_opt_get_cstring(access_ctx->ad_options, AD_ACCESS_FILTER); + if (filter != NULL) { + access_ctx->sdap_access_ctx->filter = sdap_get_access_filter( + access_ctx->sdap_access_ctx, + filter); + if (access_ctx->sdap_access_ctx->filter == NULL) { + ret = ENOMEM; + goto fail; + } + + access_ctx->sdap_access_ctx->access_rule[1] = LDAP_ACCESS_FILTER; + access_ctx->sdap_access_ctx->access_rule[2] = LDAP_ACCESS_EMPTY; + } else { + access_ctx->sdap_access_ctx->access_rule[1] = LDAP_ACCESS_EMPTY; + } *ops = &ad_access_ops; *pvt_data = access_ctx; diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c index b3a048c1cb7336cec0a5bbfebd3509c56637bed3..e5c457c24514444553f407c1de32d77cab3f7231 100644 --- a/src/providers/ldap/ldap_common.c +++ b/src/providers/ldap/ldap_common.c @@ -1757,6 +1757,25 @@ char *sdap_get_id_specific_filter(TALLOC_CTX *mem_ctx, return filter; /* NULL or not */ } +char *sdap_get_access_filter(TALLOC_CTX *mem_ctx, + const char *base_filter) +{ + char *filter = NULL; + + if (base_filter == NULL) return NULL; + + if (base_filter[0] == '(') { + /* This filter is wrapped in parentheses. + * Pass it as-is to the openldap libraries. + */ + filter = talloc_strdup(mem_ctx, base_filter); + } else { + filter = talloc_asprintf(mem_ctx, "(%s)", base_filter); + } + + return filter; +} + errno_t sdap_attrs_get_sid_str(TALLOC_CTX *mem_ctx, struct sdap_idmap_ctx *idmap_ctx, diff --git a/src/providers/ldap/ldap_common.h b/src/providers/ldap/ldap_common.h index fb9a34c6067521f8d28fb403b97ca6394918f303..0bd6c9cc2116db3f7c024c0d3cfc0035eee32357 100644 --- a/src/providers/ldap/ldap_common.h +++ b/src/providers/ldap/ldap_common.h @@ -261,6 +261,9 @@ char *sdap_get_id_specific_filter(TALLOC_CTX *mem_ctx, const char *base_filter, const char *extra_filter); +char *sdap_get_access_filter(TALLOC_CTX *mem_ctx, + const char *base_filter); + errno_t msgs2attrs_array(TALLOC_CTX *mem_ctx, size_t count, struct ldb_message **msgs, struct sysdb_attrs ***attrs); diff --git a/src/providers/ldap/ldap_init.c b/src/providers/ldap/ldap_init.c index 341338ca491593d906cff1ee71b040c2d0dea38b..17874b1325d3e5bf2eded62c6f022364b84a5c2a 100644 --- a/src/providers/ldap/ldap_init.c +++ b/src/providers/ldap/ldap_init.c @@ -341,7 +341,7 @@ int sssm_ldap_access_init(struct be_ctx *bectx, access_ctx->access_rule[c] = LDAP_ACCESS_FILTER; filter = dp_opt_get_cstring(access_ctx->id_ctx->opts->basic, - SDAP_ACCESS_FILTER); + SDAP_ACCESS_FILTER); if (filter == NULL) { /* It's okay if this is NULL. In that case we will simply act * like the 'deny' provider. @@ -349,24 +349,14 @@ int sssm_ldap_access_init(struct be_ctx *bectx, DEBUG(0, ("Warning: LDAP access rule 'filter' is set, " "but no ldap_access_filter configured. " "All domain users will be denied access.\n")); - } - else { - if (filter[0] == '(') { - /* This filter is wrapped in parentheses. - * Pass it as-is to the openldap libraries. - */ - access_ctx->filter = filter; - } - else { - /* Add parentheses around the filter */ - access_ctx->filter = talloc_asprintf(access_ctx, "(%s)", filter); - if (access_ctx->filter == NULL) { - ret = ENOMEM; - goto done; - } + } else { + access_ctx->filter = sdap_get_access_filter(access_ctx, + filter); + if (access_ctx->filter == NULL) { + ret = ENOMEM; + goto done; } } - } else if (strcasecmp(order_list[c], LDAP_ACCESS_EXPIRE_NAME) == 0) { access_ctx->access_rule[c] = LDAP_ACCESS_EXPIRE; -- 1.8.3.1