[SSSD] [PATCH] Add group support to the simple access provider
Sumit Bose
sbose at redhat.com
Mon Dec 13 12:14:15 UTC 2010
On Fri, Dec 10, 2010 at 02:21:40PM -0500, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 12/10/2010 06:34 AM, Sumit Bose wrote:
> > On Thu, Dec 09, 2010 at 10:20:09AM -0500, Stephen Gallagher wrote:
> > This patch adds simple_allow_groups and simple_deny_groups options
> > to the simple access provider. It makes it possible to grant or
> > deny access based on a user's group memberships within the domain.
> >
> > This patch makes one minor change to previous functionality: now
> > all deny rules will supersede allow rules. Previously, if both
> > simple_allow_users and simple_deny_users were set with the same
> > value, the allow would win.
> >
> > Fixes https://fedorahosted.org/sssd/ticket/440
>
> +
> + /* Construct a list of the user's groups */
> + for (i = 0; i < msg->num_elements; i++) {
> + if (strcasecmp(msg->elements[i].name, SYSDB_MEMBEROF) == 0) {
>
> > If there is no SYSDB_MEMBEROF groups and j might be undefined later on.
> > Why do you run the loop yourself instead of using ldb_msg_find_element() ?
>
> Because I glanced at all of the other ldb_msg_find_* functions and saw
> that they said "Assumes that elements are single valued", so I
> reimplemented it. I've switched to using ldb_msg_find_element() now.
>
> Good catch, by the way. I didn't think about the case where the user has
> no groups but the primary.
>
> New patch attached.
ACK.
While testing this patch it came to my mind that it would be nice to see
a higher level debug message explaining why the access was denied. But
this can be easily done in a different patch.
bye,
Sumit
>
> - --
> Stephen Gallagher
> RHCE 804006346421761
>
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk0CfcMACgkQeiVVYja6o6O6EACgocA2AF6kJJ2nNvpBXC1a7VPp
> 6M4AoIENoVqW6A40JGJwDfX4mcTe+D3n
> =ohMT
> -----END PGP SIGNATURE-----
More information about the sssd-devel
mailing list