[SSSD] [PATCH] simple-access-provider: make user grp res more robust
Jakub Hrozek
jhrozek at redhat.com
Mon Apr 27 13:36:51 UTC 2015
On Mon, Apr 27, 2015 at 03:05:32PM +0200, Pavel Reichl wrote:
> @@ -772,9 +776,11 @@ static void simple_access_check_done(struct tevent_req *subreq)
> struct simple_access_check_state *state =
> tevent_req_data(req, struct simple_access_check_state);
> errno_t ret;
> + bool failed_to_resolve_group;
>
> /* We know the names now. Run the check. */
> - ret = simple_check_get_groups_recv(subreq, state, &state->group_names);
> + ret = simple_check_get_groups_recv(subreq, state, &state->group_names,
> + &failed_to_resolve_group);
> talloc_zfree(subreq);
> if (ret == ENOENT) {
> /* If the user wasn't found, just shortcut */
> @@ -786,6 +792,18 @@ static void simple_access_check_done(struct tevent_req *subreq)
> "Could not collect groups of user %s\n", state->username);
> tevent_req_error(req, ret);
> return;
> + } else if (ret == EOK && failed_to_resolve_group) {
This one looks good, but this change also got me wondering -- why change
the simple_check_get_groups_ request at all and not just return a
separate error code? ERR_SIMPLE_GROUPS_MISSING instead of branching on
EOK and another boolean?
> + DEBUG(SSSDBG_OP_FAILURE,
> + "Could not collect groups of user %s\n", state->username);
> + if (state->ctx->deny_groups == NULL) {
> + DEBUG(SSSDBG_TRACE_FUNC,
> + "But no deny groups were defined so we can continue.\n");
> + } else {
> + DEBUG(SSSDBG_OP_FAILURE,
> + "Some deny groups were defined, we can't continue\n");
> + tevent_req_error(req, ret);
> + return;
> + }
> }
>
> ret = simple_check_groups(state->ctx, state->group_names,
> --
> 2.1.0
>
More information about the sssd-devel
mailing list