Hi, this patch makes the IPA HBAC access provider more flexible and should fix trac ticket #777.
bye, Sumit
From 88ccec786960a105a24b5368f783528b2c92e999 Mon Sep 17 00:00:00 2001 From: Sumit Bose <sb...@redhat.com> Date: Tue, 18 Jan 2011 14:50:22 +0100 Subject: [PATCH] Add ipa_hbac_search_base config option --- src/config/SSSDConfig.py | 1 + src/config/etc/sssd.api.d/sssd-ipa.conf | 1 + src/man/sssd-ipa.5.xml | 13 +++++ src/providers/ipa/ipa_access.c | 91 +++++++++++++------------------ src/providers/ipa/ipa_access.h | 2 +- src/providers/ipa/ipa_common.c | 3 +- src/providers/ipa/ipa_common.h | 1 + 7 files changed, 58 insertions(+), 54 deletions(-) diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py index aed683b..3191ad7 100644 --- a/src/config/SSSDConfig.py +++ b/src/config/SSSDConfig.py @@ -91,6 +91,7 @@ option_strings = { 'ipa_hostname' : _('IPA client hostname'), 'ipa_dyndns_update' : _("Whether to automatically update the client's DNS entry in FreeIPA"), 'ipa_dyndns_iface' : _("The interface whose IP should be used for dynamic DNS updates"), + 'ipa_hbac_search_base' : _("Search base for HBAC related objects"), # [provider/krb5] 'krb5_kdcip' : _('Kerberos server address'), diff --git a/src/config/etc/sssd.api.d/sssd-ipa.conf b/src/config/etc/sssd.api.d/sssd-ipa.conf index 42a7555..1b4427a 100644 --- a/src/config/etc/sssd.api.d/sssd-ipa.conf +++ b/src/config/etc/sssd.api.d/sssd-ipa.conf @@ -4,6 +4,7 @@ ipa_server = str, None, false ipa_hostname = str, None, false ipa_dyndns_update = bool, None, false ipa_dyndns_iface = str, None, false +ipa_hbac_search_base = str, None, false ldap_uri = str, None, false ldap_search_base = str, None, false ldap_schema = str, None, false diff --git a/src/man/sssd-ipa.5.xml b/src/man/sssd-ipa.5.xml index afa52e3..606581d 100644 --- a/src/man/sssd-ipa.5.xml +++ b/src/man/sssd-ipa.5.xml @@ -132,6 +132,19 @@ </varlistentry> <varlistentry> + <term>ipa_hbac_search_base (string)</term> + <listitem> + <para> + Optional. Use the given string as search base for + HBAC related objects. + </para> + <para> + Default: Use base DN + </para> + </listitem> + </varlistentry> + + <varlistentry> <term>krb5_validate (boolean)</term> <listitem> <para> diff --git a/src/providers/ipa/ipa_access.c b/src/providers/ipa/ipa_access.c index feddc87..02b0a77 100644 --- a/src/providers/ipa/ipa_access.c +++ b/src/providers/ipa/ipa_access.c @@ -60,6 +60,30 @@ #define HBAC_HOSTS_SUBDIR "hbac_hosts" #define HBAC_SERVICES_SUBDIR "hbac_services" +static char *get_hbac_search_base(TALLOC_CTX *mem_ctx, + struct dp_option *ipa_options) +{ + char *base; + int ret; + + base = dp_opt_get_string(ipa_options, IPA_HBAC_SEARCH_BASE); + if (base != NULL) { + return talloc_strdup(mem_ctx, base); + } + + DEBUG(9, ("ipa_hbac_search_base not available, trying base DN.\n")); + + ret = domain_to_basedn(mem_ctx, + dp_opt_get_string(ipa_options, IPA_DOMAIN), + &base); + if (ret != EOK) { + DEBUG(1, ("domain_to_basedn failed.\n")); + return NULL; + } + + return base; +} + static errno_t msgs2attrs_array(TALLOC_CTX *mem_ctx, size_t count, struct ldb_message **msgs, struct sysdb_attrs ***attrs) @@ -441,11 +465,9 @@ done: struct hbac_get_service_data_state { struct hbac_ctx *hbac_ctx; - const char *basedn; bool offline; char *services_filter; - char *services_search_base; const char **services_attrs; struct sysdb_attrs **services_reply_list; size_t services_reply_count; @@ -456,8 +478,7 @@ struct hbac_get_service_data_state { static void hbac_services_get_done(struct tevent_req *subreq); struct tevent_req *hbac_get_service_data_send(TALLOC_CTX *memctx, - struct hbac_ctx *hbac_ctx, - const char *basedn) + struct hbac_ctx *hbac_ctx) { struct tevent_req *req = NULL; struct tevent_req *subreq = NULL; @@ -472,21 +493,12 @@ struct tevent_req *hbac_get_service_data_send(TALLOC_CTX *memctx, } state->hbac_ctx = hbac_ctx; - state->basedn = basedn; state->services_reply_list = NULL; state->services_reply_count = 0; state->current_item = 0; - state->services_search_base = talloc_asprintf(state, IPA_SERVICES_BASE_TMPL, - basedn); - if (state->services_search_base == NULL) { - DEBUG(1, ("Failed to create service search base.\n")); - ret = ENOMEM; - goto fail; - } - state->services_attrs = talloc_array(state, const char *, 7); if (state->services_attrs == NULL) { DEBUG(1, ("Failed to allocate service attribute list.\n")); @@ -538,7 +550,7 @@ struct tevent_req *hbac_get_service_data_send(TALLOC_CTX *memctx, hbac_ctx_ev(state->hbac_ctx), hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts, sdap_handle, - state->services_search_base, + state->hbac_ctx->hbac_search_base, LDAP_SCOPE_SUB, state->services_filter, state->services_attrs, @@ -715,7 +727,6 @@ struct hbac_get_host_info_state { struct hbac_ctx *hbac_ctx; char *host_filter; - char *host_search_base; const char **host_attrs; struct sysdb_attrs **host_reply_list; @@ -729,7 +740,6 @@ static void hbac_get_host_memberof_done(struct tevent_req *subreq); static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx, struct hbac_ctx *hbac_ctx, - const char *basedn, const char **hostnames) { struct tevent_req *req = NULL; @@ -740,8 +750,8 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx, int ret; int i; - if (hostnames == NULL || basedn == NULL) { - DEBUG(1, ("Missing hostnames or domain.\n")); + if (hostnames == NULL) { + DEBUG(1, ("Missing hostnames.\n")); return NULL; } @@ -787,14 +797,6 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx, goto fail; } - state->host_search_base = talloc_asprintf(state, IPA_HOST_BASE_TMPL, - basedn); - if (state->host_search_base == NULL) { - DEBUG(1, ("Failed to create host search base.\n")); - ret = ENOMEM; - goto fail; - } - state->host_attrs = talloc_array(state, const char *, 8); if (state->host_attrs == NULL) { DEBUG(1, ("Failed to allocate host attribute list.\n")); @@ -835,7 +837,7 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx, subreq = sdap_get_generic_send(state, hbac_ctx_ev(state->hbac_ctx), hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts, sdap_handle, - state->host_search_base, + state->hbac_ctx->hbac_search_base, LDAP_SCOPE_SUB, state->host_filter, state->host_attrs, @@ -1019,7 +1021,6 @@ struct hbac_get_rules_state { const char *host_dn; const char **memberof; char *hbac_filter; - char *hbac_search_base; const char **hbac_attrs; struct ldb_message *old_rules; @@ -1032,7 +1033,6 @@ static void hbac_rule_get_done(struct tevent_req *subreq); static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx, struct hbac_ctx *hbac_ctx, - const char *basedn, const char *host_dn, const char **memberof) { @@ -1044,8 +1044,8 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx, int ret; int i; - if (host_dn == NULL || basedn == NULL) { - DEBUG(1, ("Missing host_dn or domain.\n")); + if (host_dn == NULL) { + DEBUG(1, ("Missing host_dn.\n")); return NULL; } @@ -1064,14 +1064,6 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx, state->hbac_reply_count = 0; state->current_item = 0; - state->hbac_search_base = talloc_asprintf(state, IPA_HBAC_BASE_TMPL, - basedn); - if (state->hbac_search_base == NULL) { - DEBUG(1, ("Failed to create HBAC search base.\n")); - ret = ENOMEM; - goto fail; - } - state->hbac_attrs = talloc_array(state, const char *, 17); if (state->hbac_attrs == NULL) { DEBUG(1, ("Failed to allocate HBAC attribute list.\n")); @@ -1156,7 +1148,7 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx, subreq = sdap_get_generic_send(state, hbac_ctx_ev(state->hbac_ctx), hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts, sdap_handle, - state->hbac_search_base, + state->hbac_ctx->hbac_search_base, LDAP_SCOPE_SUB, state->hbac_filter, state->hbac_attrs, @@ -1682,11 +1674,10 @@ void ipa_access_handler(struct be_req *be_req) hbac_ctx->sdap_ctx = ipa_access_ctx->sdap_ctx; hbac_ctx->ipa_options = ipa_access_ctx->ipa_options; hbac_ctx->tr_ctx = ipa_access_ctx->tr_ctx; - ret = domain_to_basedn(hbac_ctx, - dp_opt_get_string(hbac_ctx->ipa_options, IPA_DOMAIN), - &hbac_ctx->ldap_basedn); - if (ret != EOK) { - DEBUG(1, ("domain_to_basedn failed.\n")); + hbac_ctx->hbac_search_base = get_hbac_search_base(hbac_ctx, + hbac_ctx->ipa_options); + if (hbac_ctx->hbac_search_base == NULL) { + DEBUG(1, ("No HBAC search base found.\n")); goto fail; } @@ -1818,9 +1809,7 @@ static int hbac_get_host_info_step(struct hbac_ctx *hbac_ctx) pd->rhost = discard_const_p(char, hostlist[0]); } - subreq = hbac_get_host_info_send(hbac_ctx, hbac_ctx, - hbac_ctx->ldap_basedn, - hostlist); + subreq = hbac_get_host_info_send(hbac_ctx, hbac_ctx, hostlist); if (!subreq) { DEBUG(1, ("hbac_get_host_info_send failed.\n")); return ENOMEM; @@ -1866,8 +1855,7 @@ static void hbac_get_host_info_done(struct tevent_req *req) pam_status = PAM_PERM_DENIED; goto fail; } - req = hbac_get_rules_send(hbac_ctx, hbac_ctx, - hbac_ctx->ldap_basedn, local_hhi->dn, + req = hbac_get_rules_send(hbac_ctx, hbac_ctx, local_hhi->dn, local_hhi->memberof); if (req == NULL) { DEBUG(1, ("hbac_get_rules_send failed.\n")); @@ -1898,8 +1886,7 @@ static void hbac_get_rules_done(struct tevent_req *req) return; } - req = hbac_get_service_data_send(hbac_ctx, hbac_ctx, - hbac_ctx->ldap_basedn); + req = hbac_get_service_data_send(hbac_ctx, hbac_ctx); if (req == NULL) { DEBUG(1, ("hbac_get_service_data_send failed.\n")); goto failed; diff --git a/src/providers/ipa/ipa_access.h b/src/providers/ipa/ipa_access.h index ba56700..52b2f07 100644 --- a/src/providers/ipa/ipa_access.h +++ b/src/providers/ipa/ipa_access.h @@ -60,7 +60,7 @@ struct hbac_ctx { const char *user_dn; size_t groups_count; const char **groups; - char *ldap_basedn; + char *hbac_search_base; struct sysdb_attrs **hbac_services_list; size_t hbac_services_count; }; diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c index 6b4f64f..407b9ef 100644 --- a/src/providers/ipa/ipa_common.c +++ b/src/providers/ipa/ipa_common.c @@ -34,7 +34,8 @@ struct dp_option ipa_basic_opts[] = { { "ipa_server", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "ipa_hostname", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "ipa_dyndns_update", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, - { "ipa_dyndns_iface", DP_OPT_STRING, NULL_STRING, NULL_STRING} + { "ipa_dyndns_iface", DP_OPT_STRING, NULL_STRING, NULL_STRING}, + { "ipa_hbac_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING} }; struct dp_option ipa_def_ldap_opts[] = { diff --git a/src/providers/ipa/ipa_common.h b/src/providers/ipa/ipa_common.h index 49618f0..294e84f 100644 --- a/src/providers/ipa/ipa_common.h +++ b/src/providers/ipa/ipa_common.h @@ -48,6 +48,7 @@ enum ipa_basic_opt { IPA_HOSTNAME, IPA_DYNDNS_UPDATE, IPA_DYNDNS_IFACE, + IPA_HBAC_SEARCH_BASE, IPA_OPTS_BASIC /* opts counter */ }; -- 1.7.3.3
_______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel