-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This patch adds simple_allow_groups and simple_deny_groups options to the simple access provider. It makes it possible to grant or deny access based on a user's group memberships within the domain. This patch makes one minor change to previous functionality: now all deny rules will supersede allow rules. Previously, if both simple_allow_users and simple_deny_users were set with the same value, the allow would win. Fixes https://fedorahosted.org/sssd/ticket/440 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/

+ + /* Construct a list of the user's groups */ + for (i = 0; i < msg->num_elements; i++) { + if (strcasecmp(msg->elements[i].name, SYSDB_MEMBEROF) == 0) {

+ /* Get the groups from the memberOf entries + * Allocate the array with room for both the NULL + * terminator and the primary group + */ + groups = talloc_array(tmp_ctx, char *, msg->elements[i].num_values + 2); + if (!groups) { + ret = ENOMEM; + goto done; + } + + for (j = 0; j < msg->elements[i].num_values; j++) { + ret = sysdb_group_dn_name( + ctx->sysdb, tmp_ctx, + (char *)msg->elements[i].values[j].data, + &groups[j]); + if (ret != EOK) { + goto done; + } + } + } + } + + /* Get the user's primary group */ + gid = ldb_msg_find_attr_as_uint64(msg, SYSDB_GIDNUM, 0); + if (!gid) { + ret = EINVAL; + goto done; + } + talloc_zfree(msg); + + ret = sysdb_search_group_by_gid(tmp_ctx, ctx->sysdb, ctx->domain, + gid, group_attrs, &msg); + if (ret != EOK) { + DEBUG(1, ("Could not look up primary group [%lu]: [%d][%s]\n", + gid, ret, strerror(ret))); + goto done; + } + + primary_group = ldb_msg_find_attr_as_string(msg, SYSDB_NAME, NULL); + if (!primary_group) { + ret = EINVAL; + goto done; + } + + groups[j] = talloc_strdup(tmp_ctx, primary_group); + if (!groups[j]) { + ret = ENOMEM; + goto done; + } + groups[j+1] = NULL; + talloc_zfree(msg); +

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 12/10/2010 06:34 AM, Sumit Bose wrote: > On Thu, Dec 09, 2010 at 10:20:09AM -0500, Stephen Gallagher wrote: > This patch adds simple_allow_groups and simple_deny_groups options > to the simple access provider. It makes it possible to grant or > deny access based on a user's group memberships within the domain. > > This patch makes one minor change to previous functionality: now > all deny rules will supersede allow rules. Previously, if both > simple_allow_users and simple_deny_users were set with the same > value, the allow would win. > > Fixes https://fedorahosted.org/sssd/ticket/440 + + /* Construct a list of the user's groups */ + for (i = 0; i < msg->num_elements; i++) { + if (strcasecmp(msg->elements[i].name, SYSDB_MEMBEROF) == 0) { > If there is no SYSDB_MEMBEROF groups and j might be undefined later on. > Why do you run the loop yourself instead of using ldb_msg_find_element() ? Because I glanced at all of the other ldb_msg_find_* functions and saw that they said "Assumes that elements are single valued", so I reimplemented it. I've switched to using ldb_msg_find_element() now. Good catch, by the way. I didn't think about the case where the user has no groups but the primary. New patch attached.

- -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk0CfcMACgkQeiVVYja6o6O6EACgocA2AF6kJJ2nNvpBXC1a7VPp 6M4AoIENoVqW6A40JGJwDfX4mcTe+D3n =ohMT -----END PGP SIGNATURE-----