[SSSD] [PATCH] simple-access-provider: make user grp res more robust

Jakub Hrozek jhrozek at redhat.com
Mon Apr 27 13:36:51 UTC 2015


On Mon, Apr 27, 2015 at 03:05:32PM +0200, Pavel Reichl wrote:
> @@ -772,9 +776,11 @@ static void simple_access_check_done(struct tevent_req *subreq)
>      struct simple_access_check_state *state =
>                          tevent_req_data(req, struct simple_access_check_state);
>      errno_t ret;
> +    bool failed_to_resolve_group;
>  
>      /* We know the names now. Run the check. */
> -    ret = simple_check_get_groups_recv(subreq, state, &state->group_names);
> +    ret = simple_check_get_groups_recv(subreq, state, &state->group_names,
> +                                       &failed_to_resolve_group);
>      talloc_zfree(subreq);
>      if (ret == ENOENT) {
>          /* If the user wasn't found, just shortcut */
> @@ -786,6 +792,18 @@ static void simple_access_check_done(struct tevent_req *subreq)
>                "Could not collect groups of user %s\n", state->username);
>          tevent_req_error(req, ret);
>          return;
> +    } else if (ret == EOK && failed_to_resolve_group) {

This one looks good, but this change also got me wondering -- why change
the simple_check_get_groups_ request at all and not just return a
separate error code? ERR_SIMPLE_GROUPS_MISSING instead of branching on
EOK and another boolean?

> +        DEBUG(SSSDBG_OP_FAILURE,
> +              "Could not collect groups of user %s\n", state->username);
> +        if (state->ctx->deny_groups == NULL) {
> +            DEBUG(SSSDBG_TRACE_FUNC,
> +                  "But no deny groups were defined so we can continue.\n");
> +        } else {
> +            DEBUG(SSSDBG_OP_FAILURE,
> +                  "Some deny groups were defined, we can't continue\n");
> +            tevent_req_error(req, ret);
> +            return;
> +        }
>      }
>  
>      ret = simple_check_groups(state->ctx, state->group_names,
> -- 
> 2.1.0
> 



More information about the sssd-devel mailing list