[SSSD] [PATCH] Add simple access provider

David O'Brien davido at redhat.com
Thu Mar 4 02:38:43 UTC 2010


Sumit Bose wrote:
> On Thu, Feb 25, 2010 at 08:50:43PM +0100, Sumit Bose wrote:
>> On Thu, Feb 25, 2010 at 01:27:34PM -0500, Stephen Gallagher wrote:
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>>
>>> On 02/25/2010 12:31 PM, Sumit Bose wrote:
>>>> Hi,
>>>>
>>>> this is the second try to fix #392. This patch adds a new provider
>>>> called simple wuth na access target which can allow/deny access based on
>>>> a list of user names.
>>>
>>> Nack.
>>>
>>> You didn't update the SSSDConfigTest.py. It's failing.
>>>
>>> The manpages are very hard to follow. Might I suggest that they read:
>>>
>>>
>>> NAME
>>> sssd-simple - the configuration file for SSSD's 'simple' access-control
>>> provider
>>>
>>>
>>> DESCRIPTION
>>> This manual page describes the configuration of the simple
>>> access-control provider for sssd(8). For a detailed syntax reference,
>>> refer to the “FILE FORMAT” section of the sssd.conf(5) manual page.
>>>
>>> The simple access provider grants or denies access based on an access
>>> or deny list of user names. Here the following rules apply:
>>>
>>> ·   If both lists are empty, access is granted
>>>
>>> ·   If simple_allow_users is set, only users from this list are allowed
>>>     access.
>>>     This setting supersedes the simple_deny_users list (which would be
>>>     redundant.
>>>
>>> ·   If the simple_allow_users list is empty, users are allowed access
>>>     unless they appear in the simple_deny_users list
>>>
>>> CONFIGURATION OPTIONS
>>>        Refer to the section “DOMAIN SECTIONS” of the sssd.conf(5) manual
>>> page
>>>        for details on the configuration of an SSSD domain.
>>>
>>>        simple_allow_users (string)
>>>            Comma separated list of users who are allowed to log in.
>>>
>>>        simple_deny_users (string)
>>>            Comma separated list of users who are rejected if
>>>            simple_allow_users is not set.
>>>
>>> EXAMPLE
>>>        The following example assumes that SSSD is correctly configured and
>>>        example.com is one of the domains in the [sssd] section. This
>>> examples
>>>        shows only the simple access provider-specific options.
>>>
>>>                [domain/example.com]
>>>                access_provider = simple
>>>                simple_allow_users = user1, user2
>>>
>>> SEE ALSO
>>>        sssd.conf(5), sssd(8)
>>>
>>> AUTHORS
>>>        The SSSD upstream - http://fedorahosted.org/sssd
>>>
>>>
>>> - -- 
>>> Stephen Gallagher
>>> RHCE 804006346421761
>>>
>>> Delivering value year after year.
>>> Red Hat ranks #1 in value among software vendors.
>>> http://www.redhat.com/promo/vendor/
>>> -----BEGIN PGP SIGNATURE-----
>>> Version: GnuPG v1.4.10 (GNU/Linux)
>>> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>>>
>>> iEYEARECAAYFAkuGwRYACgkQeiVVYja6o6NDHQCeOpet+8kppGGyxVUkhCm+Za4I
>>> J74AoJN6Koz74cdXKsNEz6qE0kQhy9D8
>>> =7923
>>> -----END PGP SIGNATURE-----
>> new version attached.
>>
> 
> Hi,
> 
> I forgot to include a hunk in the Makefile.am patch. New version
> attached.
> 
> bye,
> Sumit
> 

Should allowing access override denying access in the interests of good 
security practices? e.g., if I'm in both Allow and Deny lists, I'd 
expect to be denied access.

-- 

David O'Brien
Red Hat Asia Pacific Pty Ltd

He who asks is a fool for five minutes, but he who does not ask remains 
a fool forever."
  ~ Chinese proverb



More information about the sssd-devel mailing list