[SSSD] [PATCH] Add group support to the simple access provider

Sumit Bose sbose at redhat.com
Mon Dec 13 12:14:15 UTC 2010


On Fri, Dec 10, 2010 at 02:21:40PM -0500, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 12/10/2010 06:34 AM, Sumit Bose wrote:
> > On Thu, Dec 09, 2010 at 10:20:09AM -0500, Stephen Gallagher wrote:
> > This patch adds simple_allow_groups and simple_deny_groups options
> > to the simple access provider. It makes it possible to grant or
> > deny access based on a user's group memberships within the domain.
> > 
> > This patch makes one minor change to previous functionality: now
> > all deny rules will supersede allow rules. Previously, if both
> > simple_allow_users and simple_deny_users were set with the same
> > value, the allow would win.
> > 
> > Fixes https://fedorahosted.org/sssd/ticket/440
> 
> +
> +    /* Construct a list of the user's groups */
> +    for (i = 0; i < msg->num_elements; i++) {
> +        if (strcasecmp(msg->elements[i].name, SYSDB_MEMBEROF) == 0) {
> 
> > If there is no SYSDB_MEMBEROF groups and j might be undefined later on.
> > Why do you run the loop yourself instead of using ldb_msg_find_element() ?
> 
> Because I glanced at all of the other ldb_msg_find_* functions and saw
> that they said "Assumes that elements are single valued", so I
> reimplemented it. I've switched to using ldb_msg_find_element() now.
> 
> Good catch, by the way. I didn't think about the case where the user has
> no groups but the primary.
> 
> New patch attached.

ACK.

While testing this patch it came to my mind that it would be nice to see
a higher level debug message explaining why the access was denied. But
this can be easily done in a different patch.

bye,
Sumit

> 
> - -- 
> Stephen Gallagher
> RHCE 804006346421761
> 
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAk0CfcMACgkQeiVVYja6o6O6EACgocA2AF6kJJ2nNvpBXC1a7VPp
> 6M4AoIENoVqW6A40JGJwDfX4mcTe+D3n
> =ohMT
> -----END PGP SIGNATURE-----



More information about the sssd-devel mailing list