[SSSD] [PATCH] Convert the simple access check to new error codes

Pavel Březina pbrezina at redhat.com
Thu Apr 18 08:59:11 UTC 2013


On 04/17/2013 11:39 AM, Jakub Hrozek wrote:
> Hi,
>
> I took a look into converting the simple access provider to use the new
> error codes and I think a patch might not even be needed. The current
> request returns errno on error and boolean for access granted/denied.
>
> I think the boolean is actually nice in the case and converting to
> ERR_ACCESS_DENIED instead of false doesn't make much sense.
>
> The attached patch just makes the top-level request called by the DP
> handler return ERR_ACCOUNT_UNKNOWN in case the user passed via struct
> pam_data does not exist in sysdb and ERR_INTERNAL instead of EIO for
> internal errors. It would make the error reporting somewhat nicer, I
> think, but even if we drop the patch I would like to close
> https://fedorahosted.org/sssd/ticket/453

Nack.

You need to use sss_strerror() when dealing with new error codes.

> @@ -629,11 +631,15 @@ struct tevent_req *simple_access_check_send(TALLOC_CTX *mem_ctx,
>       DEBUG(SSSDBG_FUNC_DATA, ("Simple access check for %s\n", username));
>
>       ret = simple_check_users(ctx, username, &state->access_granted);
> -    if (ret != EAGAIN) {
> -        /* Both access denied and an error */
> +    if (ret != EOK && ret != EAGAIN) {
> +        ret = ERR_INTERNAL;
> +        goto immediate;
> +    } else if (ret == EOK) {
>           goto immediate;
>       }

How about
if (ret == EOK) {
     goto immediate;
} else if (ret != EAGAIN) {
     ret = ERR_INTERNAL;
     goto immediate;
}




More information about the sssd-devel mailing list