[SSSD] Time-Based Policies in FreeIPA [update]
Stanislav Laznicka
slaznick at redhat.com
Fri Jul 17 12:12:16 UTC 2015
Hi,
So my concerns about thread-safety of the solution seem to be
exaggerated, that is a good thing. Let me post just a little update of
the work on SSSD side for time policies in FreeIPA (also attaching
curent patches).
Thanks to the guys in the Brno office, we've been able to fix the Python
bindings I prepared some time ago. I have also written some Python tests
for the HbacTimeRules class according to the HbacRuleElement class.
Currently, a time attribute still needs to be added to the HbacRequest
class so that it can be used for HBAC evaluation in Python. I was also
wondering whether HbacTimeRules object should react when a wrong time
policy string is handed to it (e.g. you want to set "2000" as access
time instead of "timeofday=2000"). If such a time rule gets evaluated,
the mistake gets detected anyway.
One thing I was also thinking is that you may want to have the
time-rules language parsed by regular expressions in ipa_timerules.c
module. Currently, this is done by a finite automaton which works just
fine but the code may not be that readable.
Also note that the IPA_TIMEZONE constant was renamed to "ipaTimeZone"
from "timezone" according to the latest changes I made on FreeIPA side,
should you decide to try it and the timezones do not work. I have not
yet published those FreeIPA changes, but other than this, they are
rather codewise-cosmetical.
Cheers,
Standa
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Added-caching-of-time-policies-for-IPA-HBAC-rules.patch
Type: text/x-patch
Size: 11565 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150717/e2420b6b/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Added-evaluation-of-time-policies-in-HBAC-objects.patch
Type: text/x-patch
Size: 19712 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150717/e2420b6b/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-Added-Python-bindings-for-FreeIPA-time-policies.patch
Type: text/x-patch
Size: 27294 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150717/e2420b6b/attachment-0002.bin>
More information about the sssd-devel
mailing list