[SSSD] [PATCH] AD: add support for generic cse processing

Yassir Elley yelley at redhat.com
Fri Sep 12 04:26:46 UTC 2014


Hi guys,

As you know, the current implementation is tightly coupled with hbac cse processing. It would be useful to provide an extensible design in order to more easily accomodate additional cse processing plugins. To that end, the attached patch refactors the gpo implementation by defining a standard interface for gpo cse plugins. The details of the hbac cse processing are now encapsulated in an hbac cse plugin (ad_gpo_cse_hbac.c). The main gpo code (ad_gpo.c) is almost totally unaware of the details of a cse plugin. I say "almost" b/c the initial bootstrap registration of the cse plugins currently requires ad_gpo.c to be aware of the cse-specific register functions. I suspect this design can be improved upon.

I have copied below the parts of ad_gpo.h that define the interface. Note that this interface is meant for use by sssd-internal plugins. Also note that this patch includes the functionality contained in the previous patch that was just sent to the list (resolve conflicting policy settings correctly), so if changes are made to the previous patch, the same changes will need to be made to this refactored patch as well. Finally, note that both this patch and the previous patch have the same git commit as a parent.

Regards,
Yassir.

Excerpts from ad_gpo.h:

/*
 * every cse plugin (each corresponding to a cse-guid) must implement
 * the following gp_cse_methods; if one or more don't apply, the cse plugin
 * can simply return EOK
 *
 * the purpose of the cse_context is to allow the cse plugin to store
 * cse-specific information in a way that is opaque to the cse engine;
 * the cse_context is initialized in cse_initialize, and is then passed
 * to each of the other methods
 */
struct gp_cse_methods {
    /*
     * the cse_initialize function can be used to create and initialize the
     * cse_context for this cse plugin; for example, it is used by the
     * hbac_cse plugin to store the hbac-specific gpo_map_options table
     */
    errno_t (*cse_initialize)(TALLOC_CTX *mem_ctx,
                              struct dp_option *ad_options,
                              void *_cse_context);
    /*
     * the cse_preprocess function can be used to perform processing
     * before gpo evaluation takes place; it is called by ad_gpo_access_send
     * before any ldap or smb processing takes place; for example, it is used by
     * the hbac_cse plugin to shortcut to GP_CSE_PERMIT or GP_CSE_DENY
     * if the service is mapped to GPO_MAP_PERMIT or GPO_MAP_DENY
     * (without having to do any gpo evaluation)
     */
    errno_t (*cse_preprocess)(TALLOC_CTX *mem_ctx,
                              void *cse_context,
                              enum gpo_access_control_mode gpo_mode,
                              const char *service,
                              enum gp_cse_return_value *_return_value);
    /*
     * the cse_process function can be used to perform per-gpo processing;
     * it is called after each gpo's policy files have been downloaded;
     * for example, it is used by the hbac_cse plugin to store each gpo's
     * policy settings in the sysdb cache (in the GPO Result object)
     */
    errno_t (*cse_process)(TALLOC_CTX *mem_ctx,
                           void *cse_context,
                           const char *smb_path,
                           struct sss_domain_info *domain);

   /*
    * the cse_postprocess function can be used to perform processing
    * after all policy files have been downloaded; for example, it is used by
    * the hbac_cse plugin to retrieve the resultant policy settings from
    * the sysdb cache, and to determine whether logon access is granted or
    * denied for the specified user_sid and group_sids.
    */
    errno_t (*cse_postprocess)(TALLOC_CTX *mem_ctx,
                               void *cse_context,
                               enum gpo_access_control_mode gpo_mode,
                               struct sss_domain_info *domain,
                               const char *user_sid,
                               const char **group_sids,
                               int group_size);
};

struct gp_cse_module {
    errno_t (*cse_register)(TALLOC_CTX *mem_ctx);
};

/*
 * when adding a new cse plugin, a gp_cse_module entry (containing the plugin's
 * register function) must be added to the global gp_cse_modules variable in
 * ad_gpo.c; additionally, the cse plugin's register function must be declared
 * here in ad_gpo.h; once this glue is in place, the cse plugin's implementation
 * must be provided in a separate .c file (which must be added to Makefile.am);
 * no other changes should be needed in order to add a new cse plugin
 */
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-AD-GPO-add-support-for-generic-cse-processing-also-r.patch
Type: text/x-patch
Size: 132855 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140912/ddc71b82/attachment.bin>


More information about the sssd-devel mailing list