[SSSD] [PATCH] Add ipa_hbac_support_srchost option to IPA provider

Stephen Gallagher sgallagh at redhat.com
Tue Nov 22 19:33:28 UTC 2011


On Fri, 2011-11-18 at 16:13 +0100, Jan Zeleny wrote:
> don't fetch all host groups if this option is set to false
> https://fedorahosted.org/sssd/ticket/1078

Nack.

I don't like setting the srchost element to NULL and checking for that.
Technically, we're violating the HBAC design by omitting the srchost
here. I'd rather that our solution be to set srchost to
HBAC_CATEGORY_ALL instead of special-casing NULL.

You're missing a comma in:
static struct sdap_attr_map hostgroup_map[] = {
...
    {"ipa_id", IPA_UNIQUE_ID IPA_UNIQUE_ID, NULL}
};

If you're going to use an sdap_attr_map, it's probably better to do the
memberOf->originalMemberOf and member->orig_member conversion in the
attribute map instead of calls to replace_attribute_name in the _done()
functions.

In ipa_hbac_host_info_done(), don't allocate the hostgroup_filter unless
we're doing the full lookup. Move it into the support_srchost if block.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111122/89745c8e/attachment.sig>


More information about the sssd-devel mailing list