[SSSD] [PATCHES] HBAC access control rewrite

Stephen Gallagher sgallagh at redhat.com
Tue Jun 7 12:11:31 UTC 2011


On Tue, 2011-06-07 at 10:41 +0200, Jakub Hrozek wrote:
> On 06/07/2011 04:59 AM, Stephen Gallagher wrote:
> > While attempting to extract the SSSD's HBAC rule evaluation into a
> > common library, I discovered several shortcomings. Some were related to
> > extracting the library, others were related to the rule evaluation
> > itself.
> > 
> > Related to extracting the library, I needed for the code to be able to
> > identify and resolve without having direct access to LDAP or the LDB.
> > This meant I could not rely on the memberOf objects to be valid.
> > 
> > As for the rule evaluation, I discovered that we were only caching for
> > offline use those remote hosts that had previously attempted to log in.
> > This meant that if the IPA server was unreachable, valid users would be
> > unable to log in from some valid machines.
> > 
> > After careful consideration (and a few false starts), I decided that a
> > total rewrite was necessary. So here it is.
> > 
> > The major changes are these: 
> > 
> > 1) We have moved to always performing a full enumeration of known IPA
> > hosts and HBAC services. This actually results in a net reduction in
> > round-trips to the LDAP server, which was a primary bottleneck.
> > Additionally, this means that we also have a full understanding when
> > offline as to whether a remote host is permitted access or not.
> > 
> > 2) I've added a configurable timeout for hbac rule refreshes to the LDAP
> > server. Previously, if we were online, EVERY pam_account() request would
> > result in at least one LDAP round-trip. By default, we'll only refresh
> > the HBAC rules every five seconds now.
> > 
> > 3) I broke the acquisition and processing of the rules, hosts and
> > services into separate C files, as ipa_access.c was getting to be much
> > to large to manage.
> > 
> > The overall view of the code (when online) is this:
> > A request comes in, we call to LDAP to get, in order, the set of known
> > hosts, the set of known PAM services and then finally the set of
> > *enabled* rules with the current ipa_hostname as the targethost.
> > 
> > And now, the patches:
> > 
> > Patch 0001: The new standalone evaluator library. It's very simple at
> > the moment (but it will become much more complex in the near future when
> > timerule evaluation is added). Jakub, Rob and I agreed on the interface
> > and Jakub is creating Python bindings for it.
> > 
> 
> I'll rebase the bindings on top of these patches and send to the list.
> 
> > Patch 0002: This is the meat of the new IPA access backend. All of the
> > helper functions necessary for looking up, storing and converting the
> > hosts, rules and services are in this patch.
> > 
> > Patch 0003: This is not really a patch as much as it is a trash can. I
> > split this from Patch 0004 to make the latter more reviewable. Patch
> > 0003 contains only the deletions of the old access provider
> > implementation.
> > 
> > Patch 0004: Adds the new IPA access provider, taking advantage of the
> > helper functions from Patch 0002.
> > 
> > Patch 0005: Adds a refresh timeout to reduce round-trips to IPA while
> > online.
> > 
> > 
> 
> Nack, msgs2attrs_array() is not defined:
> 
> src/providers/ipa/ipa_access.c: In function 'hbac_get_cached_rules':
> src/providers/ipa/ipa_access.c:589:5: error: implicit declaration of
> function 'msgs2attrs_array' [-Werror=implicit-function-declaration]
> cc1: some warnings being treated as errors


Whoops, I forgot I reordered some of my patches. I missed two at the
beginning.

Patch 0001: Retrieve the group name as well as the GID during
sysdb_initgroups() (used later for getting the user memberships of a
user for evaluating the rules)

Patch 0002: Add a helper function to convert a list of ldb_messages to
sysdb_attrs.

The other patches are the same as the previous email, but numbered +2.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Get-group-names-during-sysdb_initgroups-call.patch
Type: text/x-patch
Size: 837 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110607/94c1b30e/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Add-helper-function-msgs2attrs_array.patch
Type: text/x-patch
Size: 2323 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110607/94c1b30e/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-Add-HBAC-evaluator-and-tests.patch
Type: text/x-patch
Size: 38973 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110607/94c1b30e/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0004-Add-helper-functions-for-looking-up-HBAC-rule-compon.patch
Type: text/x-patch
Size: 85349 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110607/94c1b30e/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0005-Remove-old-HBAC-implementation.patch
Type: text/x-patch
Size: 57253 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110607/94c1b30e/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0006-Add-new-HBAC-lookup-and-evaluation-routines.patch
Type: text/x-patch
Size: 22754 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110607/94c1b30e/attachment-0005.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0007-Add-ipa_hbac_refresh-option.patch
Type: text/x-patch
Size: 6199 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110607/94c1b30e/attachment-0006.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110607/94c1b30e/attachment.sig>


More information about the sssd-devel mailing list