[SSSD] [PATCH] simple-access-provider: make user grp res more robust

Pavel Reichl preichl at redhat.com
Mon Apr 27 14:24:33 UTC 2015



On 04/27/2015 03:36 PM, Jakub Hrozek wrote:
> On Mon, Apr 27, 2015 at 03:05:32PM +0200, Pavel Reichl wrote:
>> @@ -772,9 +776,11 @@ static void simple_access_check_done(struct tevent_req *subreq)
>>       struct simple_access_check_state *state =
>>                           tevent_req_data(req, struct simple_access_check_state);
>>       errno_t ret;
>> +    bool failed_to_resolve_group;
>>   
>>       /* We know the names now. Run the check. */
>> -    ret = simple_check_get_groups_recv(subreq, state, &state->group_names);
>> +    ret = simple_check_get_groups_recv(subreq, state, &state->group_names,
>> +                                       &failed_to_resolve_group);
>>       talloc_zfree(subreq);
>>       if (ret == ENOENT) {
>>           /* If the user wasn't found, just shortcut */
>> @@ -786,6 +792,18 @@ static void simple_access_check_done(struct tevent_req *subreq)
>>                 "Could not collect groups of user %s\n", state->username);
>>           tevent_req_error(req, ret);
>>           return;
>> +    } else if (ret == EOK && failed_to_resolve_group) {
> This one looks good, but this change also got me wondering -- why change
> the simple_check_get_groups_ request at all and not just return a
> separate error code? ERR_SIMPLE_GROUPS_MISSING instead of branching on
> EOK and another boolean?
Yes, its better your way, sorry for missing that.
>
>> +        DEBUG(SSSDBG_OP_FAILURE,
>> +              "Could not collect groups of user %s\n", state->username);
>> +        if (state->ctx->deny_groups == NULL) {
>> +            DEBUG(SSSDBG_TRACE_FUNC,
>> +                  "But no deny groups were defined so we can continue.\n");
>> +        } else {
>> +            DEBUG(SSSDBG_OP_FAILURE,
>> +                  "Some deny groups were defined, we can't continue\n");
>> +            tevent_req_error(req, ret);
>> +            return;
>> +        }
>>       }
>>   
>>       ret = simple_check_groups(state->ctx, state->group_names,
>> -- 
>> 2.1.0
>>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-simple-access-provider-make-user-grp-res-more-robust.patch
Type: text/x-patch
Size: 4235 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150427/c9525b05/attachment.bin>


More information about the sssd-devel mailing list