[SSSD] Time-Based Policies in FreeIPA

Stanislav Laznicka slaznick at redhat.com
Mon Jul 27 06:59:49 UTC 2015



On 07/14/2015 08:24 PM, Dmitri Pal wrote:
> On 07/14/2015 04:50 AM, Sumit Bose wrote:
>> On Tue, Jul 14, 2015 at 09:11:28AM +0200, Stanislav Laznicka wrote:
>>> Hi,
>>>
>>> If you're a member of the FreeIPA-devel mailing list, you may 
>>> already know
>>> me. I am currently trying to re-introduce the time-based policies for
>>> FreeIPA HBAC Rules to both FreeIPA and SSSD. For some more 
>>> information, see
>>> the design at 
>>> http://www.freeipa.org/page/V4/Time-Based_Account_Policies or
>>> read the whole paper at
>>> http://www.fit.vutbr.cz/study/DP/DP.php.cs?id=17185&file=t.
>>>
>>> At the moment, I have a prototype solution which is able to decide 
>>> whether
>>> an HBAC rule should or should not apply based on the time rules 
>>> supplied
>>> with HBAC rule objects from FreeIPA. See the source code attached to 
>>> this
>>> mail, if you will. The biggest problem of this solution is that it 
>>> is not
>>> thread-safe.
>> I have not look in detain at you patches but I think thread safety is
>> not an issue here. The HBAC evaluation is done in a single process
>> without using threads. To handle concurrent task we use the tevent
>> library and asynchronous request (see
>> https://tevent.samba.org/tevent_request.html for details). This means
>> whatever you do will change the state of the whole process but as long
>> as you do it in a single function and make sure to restore the original
>> state it might be safe. I say it might because tevent handles signals as
>> well so we have to make sure the state can be recovered even if a single
>> handler runs in between.
>>
>> bye,
>> Sumit
[...]
> What about hbac test library?
> AFAIU the same library is used on client - SSSD and server - HBAC test 
> (via python) to process HBAC rules.
> What are the expectations regarding the library? Is the code going 
> inside the library? How this affects API?
>
This is very embarrassing, but I have completely overlooked your email. 
I'm so sorry.

I hope some of the questions were answered in the last update I posted a 
week ago. I have made some progress on the pyhbac library regarding the 
time policies which is indeed used as you describe. As for the Python 
API, a new class was added to support time-based rules in HBAC - 
HbacTimeRules - and its instances are now part of the HbacRule objects. 
Also, the HbacRequest objects will need to contain the information about 
the time of the request.

I expect the library to be able to allow testing the time aspect of HBAC 
rules based on a time zone that needs to be handed to the time rules 
object in an HBAC rule object (and, of course, based on the time rules 
in the time rules object in that HBAC rule).



More information about the sssd-devel mailing list