Attachment 78779 Details for Bug 58397 – Add support for permitting logins by group

[patch] Add support for permitting logins by group

Add-support-for-permitting-logins-by-group.patch (text/plain), 18.32 KB, created by Stef Walter on 2013-05-02 13:43:50 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stef Walter

Created: 2013-05-02 13:43:50 UTC

Size: 18.32 KB

patch

obsolete

>From afe6fd2743c00bc85ae892be0db657e1f7f320ff Mon Sep 17 00:00:00 2001
>From: Stef Walter <stefw@redhat.com>
>Date: Thu, 2 May 2013 14:27:34 +0200
>Subject: [PATCH] Add support for permitting logins by group
>
>https://bugs.freedesktop.org/show_bug.cgi?id=58397
>---
> dbus/org.freedesktop.realmd.xml | 15 ++++++++++
> doc/manual/realm.xml            |  6 ++++
> service/realm-example.c         |  1 +
> service/realm-kerberos.c        | 10 ++++++-
> service/realm-kerberos.h        |  4 +++
> service/realm-samba.c           |  1 +
> service/realm-sssd-ad.c         |  2 +-
> service/realm-sssd-ipa.c        |  2 +-
> service/realm-sssd.c            | 62 ++++++++++++++++++++++++++++-------------
> service/realm-sssd.h            |  1 +
> tools/realm-discover.c          |  3 ++
> tools/realm-logins.c            | 14 ++++++++--
> tools/realm.c                   | 15 +++++++---
> 13 files changed, 106 insertions(+), 30 deletions(-)
>
>diff --git a/dbus/org.freedesktop.realmd.xml b/dbus/org.freedesktop.realmd.xml
>index dee0895..6bf63d7 100644
>--- a/dbus/org.freedesktop.realmd.xml
>+++ b/dbus/org.freedesktop.realmd.xml
>@@ -411,6 +411,17 @@
> 		<property name="PermittedLogins" type="as" access="read"/>
> 
> 		
>+		<property name="PermittedGroups" type="as" access="read"/>
>+
>+		<!--
> 		  ChangeLoginPolicy:
> 		  @login_policy: the new login policy, or an empty string
> 		  @permitted_add: a list of logins to permit
>@@ -436,6 +447,10 @@
> 		      identifier chosen by the client, which can then later be
> 		      passed to org.freedesktop.realmd.Service.Cancel() in order
> 		      to cancel the operation</para></listitem>
>+		    <listitem><para><literal>groups</literal>: boolean which if
>+		    set to <literal>TRUE</literal> means that the names in
>+		    @permitted_add and @permitted_remove are group names instead
>+		    of login names.</para></listitem>
> 		  </itemizedlist>
> 
> 		  This method requires authorization for the PolicyKit action
>diff --git a/doc/manual/realm.xml b/doc/manual/realm.xml
>index f882ca6..29b70b4 100644
>--- a/doc/manual/realm.xml
>+++ b/doc/manual/realm.xml
>@@ -344,6 +344,12 @@ $ realm permit --withdraw DOMAIN\User
> 			in.</para></listitem>
> 		</varlistentry>
> 		<varlistentry>
>+			<term><option>--groups, -g</option></term>
>+			<listitem><para>Treat the specified names as groups
>+			rather than user login names. Permit login by users in
>+			the specified groups.</para></listitem>
>+		</varlistentry>
>+		<varlistentry>
> 			<term><option>--realm, -R</option></term>
> 			<listitem><para>Specify the of the realm to change login
> 			policy for.</para></listitem>
>diff --git a/service/realm-example.c b/service/realm-example.c
>index a67c06b..627b346 100644
>--- a/service/realm-example.c
>+++ b/service/realm-example.c
>@@ -326,6 +326,7 @@ realm_example_logins_async (RealmKerberos *realm,
>                             RealmKerberosLoginPolicy login_policy,
>                             const gchar **add,
>                             const gchar **remove,
>+                            GVariant *options,
>                             GAsyncReadyCallback callback,
>                             gpointer user_data)
> {
>diff --git a/service/realm-kerberos.c b/service/realm-kerberos.c
>index 439172a..116d853 100644
>--- a/service/realm-kerberos.c
>+++ b/service/realm-kerberos.c
>@@ -485,7 +485,7 @@ handle_change_login_policy (RealmDbusRealm *realm,
> 	g_return_val_if_fail (klass->logins_async != NULL, FALSE);
> 
> 	(klass->logins_async) (self, invocation, policy, (const gchar **)add,
>-	                       (const gchar **)remove, on_logins_complete,
>+	                       (const gchar **)remove, options, on_logins_complete,
> 	                       method_closure_new (self, invocation));
> 
> 	return TRUE;
>@@ -821,6 +821,14 @@ realm_kerberos_set_permitted_logins (RealmKerberos *self,
> 	realm_dbus_realm_set_permitted_logins (self->pv->realm_iface, (const gchar * const*)value);
> }
> 
>+void
>+realm_kerberos_set_permitted_groups (RealmKerberos *self,
>+                                     const gchar **value)
>+{
>+	g_return_if_fail (REALM_IS_KERBEROS (self));
>+	realm_dbus_realm_set_permitted_groups (self->pv->realm_iface, (const gchar * const*)value);
>+}
>+
> const gchar *
> realm_kerberos_login_policy_to_string (RealmKerberosLoginPolicy value)
> {
>diff --git a/service/realm-kerberos.h b/service/realm-kerberos.h
>index 0274779..241aefe 100644
>--- a/service/realm-kerberos.h
>+++ b/service/realm-kerberos.h
>@@ -58,6 +58,7 @@ struct _RealmKerberosClass {
> 	                                         RealmKerberosLoginPolicy login_policy,
> 	                                         const gchar **permitted_add,
> 	                                         const gchar **permitted_remove,
>+	                                         GVariant *options,
> 	                                         GAsyncReadyCallback callback,
> 	                                         gpointer user_data);
> 
>@@ -101,6 +102,9 @@ void                realm_kerberos_set_suggested_admin         (RealmKerberos *s
> void                realm_kerberos_set_permitted_logins        (RealmKerberos *self,
>                                                                 const gchar **value);
> 
>+void                realm_kerberos_set_permitted_groups        (RealmKerberos *self,
>+                                                                const gchar **value);
>+
> void                realm_kerberos_set_login_policy            (RealmKerberos *self,
>                                                                 RealmKerberosLoginPolicy value);
> 
>diff --git a/service/realm-samba.c b/service/realm-samba.c
>index 3f0b8b0..e795255 100644
>--- a/service/realm-samba.c
>+++ b/service/realm-samba.c
>@@ -472,6 +472,7 @@ realm_samba_logins_async (RealmKerberos *realm,
>                           RealmKerberosLoginPolicy login_policy,
>                           const gchar **add,
>                           const gchar **remove,
>+                          GVariant *options,
>                           GAsyncReadyCallback callback,
>                           gpointer user_data)
> {
>diff --git a/service/realm-sssd-ad.c b/service/realm-sssd-ad.c
>index 272c134..69f232d 100644
>--- a/service/realm-sssd-ad.c
>+++ b/service/realm-sssd-ad.c
>@@ -191,7 +191,7 @@ configure_sssd_for_domain (RealmIniConfig *config,
> 		else
> 			access_provider = "simple";
> 		section = realm_sssd_config_domain_to_section (disco->workgroup);
>-		ret = realm_sssd_set_login_policy (config, section, access_provider, NULL, NULL, error);
>+		ret = realm_sssd_set_login_policy (config, section, access_provider, NULL, NULL, FALSE, error);
> 		free (section);
> 	}
> 
>diff --git a/service/realm-sssd-ipa.c b/service/realm-sssd-ipa.c
>index 2d1bb0c..1a34587 100644
>--- a/service/realm-sssd-ipa.c
>+++ b/service/realm-sssd-ipa.c
>@@ -212,7 +212,7 @@ on_ipa_client_do_restart (GObject *source,
> 		else
> 			access_provider = "simple";
> 		section = realm_sssd_config_domain_to_section (domain);
>-		realm_sssd_set_login_policy (config, section, access_provider, NULL, NULL, &error);
>+		realm_sssd_set_login_policy (config, section, access_provider, NULL, NULL, FALSE, &error);
> 		free (section);
> 	}
> 
>diff --git a/service/realm-sssd.c b/service/realm-sssd.c
>index 8af2039..da3d553 100644
>--- a/service/realm-sssd.c
>+++ b/service/realm-sssd.c
>@@ -76,8 +76,10 @@ realm_sssd_set_login_policy (RealmIniConfig *config,
>                              const gchar *access_provider,
>                              const gchar **add_names,
>                              const gchar **remove_names,
>+                             gboolean names_are_groups,
>                              GError **error)
> {
>+	const gchar *field = names_are_groups ? "simple_allow_groups" : "simple_allow_users";
> 	gchar *allow;
> 
> 	if (!realm_ini_config_begin_change (config, error))
>@@ -85,14 +87,13 @@ realm_sssd_set_login_policy (RealmIniConfig *config,
> 
> 	if (access_provider)
> 		realm_ini_config_set (config, section, "access_provider", access_provider, NULL);
>-	realm_ini_config_set_list_diff (config, section, "simple_allow_users", ",",
>-	                                add_names, remove_names);
>+	realm_ini_config_set_list_diff (config, section, field, ",", add_names, remove_names);
> 
> 	/*
> 	 * HACK: Work around for sssd problem where it allows users if
> 	 * simple_allow_users is empty. Set it to a dollar in this case.
> 	 */
>-	allow = realm_ini_config_get (config, section, "simple_allow_users");
>+	allow = realm_ini_config_get (config, section, field);
> 	if (allow != NULL) {
> 		g_strstrip (allow);
> 		if (g_str_equal (allow, "") || g_str_equal (allow, "$") || g_str_equal (allow, ",")) {
>@@ -103,9 +104,9 @@ realm_sssd_set_login_policy (RealmIniConfig *config,
> 
> 	if (allow == NULL) {
> 		if (g_str_equal (access_provider, "simple"))
>-			realm_ini_config_set (config, section, "simple_allow_users", "$", NULL);
>+			realm_ini_config_set (config, section, field, "$", NULL);
> 		else
>-			realm_ini_config_set (config, section, "simple_allow_users", NULL, NULL);
>+			realm_ini_config_set (config, section, field, NULL, NULL);
> 	}
> 
> 	g_free (allow);
>@@ -114,7 +115,7 @@ realm_sssd_set_login_policy (RealmIniConfig *config,
> }
> 
> static gboolean
>-sssd_config_check_login_list (gchar **logins,
>+sssd_config_check_login_list (const gchar **logins,
>                               GError **error)
> {
> 	#define INVALID_CHARS ",$"
>@@ -139,11 +140,13 @@ realm_sssd_logins_async (RealmKerberos *realm,
>                          RealmKerberosLoginPolicy login_policy,
>                          const gchar **add,
>                          const gchar **remove,
>+                         GVariant *options,
>                          GAsyncReadyCallback callback,
>                          gpointer user_data)
> {
> 	RealmSssdClass *sssd_class = REALM_SSSD_GET_CLASS (realm);
> 	RealmSssd *self = REALM_SSSD (realm);
>+	gboolean names_are_groups = FALSE;
> 	EggTask *task;
> 	gchar **remove_names = NULL;
> 	gchar **add_names = NULL;
>@@ -179,21 +182,28 @@ realm_sssd_logins_async (RealmKerberos *realm,
> 		g_return_if_reached ();
> 	}
> 
>-	add_names = realm_kerberos_parse_logins (realm, TRUE, add, &error);
>-	if (add_names != NULL)
>-		remove_names = realm_kerberos_parse_logins (realm, TRUE, remove, &error);
>+	if (!g_variant_lookup (options, "groups", "b", &names_are_groups))
>+		names_are_groups = FALSE;
>+
>+	if (!names_are_groups) {
>+		add_names = realm_kerberos_parse_logins (realm, TRUE, add, &error);
>+		if (add_names != NULL)
>+			remove_names = realm_kerberos_parse_logins (realm, TRUE, remove, &error);
>+		add = (const gchar **)add_names;
>+		remove = (const gchar **)remove_names;
>+	}
> 
> 	if (error == NULL)
>-	    sssd_config_check_login_list (add_names, &error);
>+		sssd_config_check_login_list (add, &error);
> 	if (error == NULL)
>-	    sssd_config_check_login_list (remove_names, &error);
>+		sssd_config_check_login_list (remove, &error);
> 
> 	if (error == NULL) {
> 		realm_sssd_set_login_policy (self->pv->config,
> 		                             self->pv->section,
> 		                             access_provider,
>-		                             (const gchar **)add_names,
>-		                             (const gchar **)remove_names,
>+		                             add, remove,
>+		                             names_are_groups,
> 		                             &error);
> 	}
> 
>@@ -332,12 +342,14 @@ update_login_policy (RealmSssd *self)
> 	RealmSssdClass *sssd_class = REALM_SSSD_GET_CLASS (self);
> 	RealmKerberosLoginPolicy policy = REALM_KERBEROS_POLICY_NOT_SET;
> 	RealmKerberos *kerberos = REALM_KERBEROS (self);
>-	GPtrArray *permitted;
>+	GPtrArray *permitted_logins;
>+	GPtrArray *permitted_groups;
> 	gchar *access = NULL;
> 	gchar **values;
> 	gint i;
> 
>-	permitted = g_ptr_array_new_full (0, g_free);
>+	permitted_logins = g_ptr_array_new_full (0, g_free);
>+	permitted_groups = g_ptr_array_new_full (0, g_free);
> 	if (self->pv->section != NULL)
> 		access = realm_ini_config_get (self->pv->config, self->pv->section, "access_provider");
> 	if (g_strcmp0 (access, "simple") == 0) {
>@@ -345,10 +357,16 @@ update_login_policy (RealmSssd *self)
> 		                                    "simple_allow_users", ",");
> 		for (i = 0; values != NULL && values[i] != NULL; i++) {
> 			if (!g_str_equal (values[i], "") && !g_str_equal (values[i], "$"))
>-				g_ptr_array_add (permitted, realm_kerberos_format_login (kerberos, values[i]));
>+				g_ptr_array_add (permitted_logins, realm_kerberos_format_login (kerberos, values[i]));
>+		}
>+		g_strfreev (values);
>+		values = realm_ini_config_get_list (self->pv->config, self->pv->section,
>+		                                    "simple_allow_groups", ",");
>+		for (i = 0; values != NULL && values[i] != NULL; i++) {
>+			if (!g_str_equal (values[i], "") && !g_str_equal (values[i], "$"))
>+				g_ptr_array_add (permitted_groups, g_strdup (values[i]));
> 		}
> 		g_strfreev (values);
>-		g_free (access);
> 		policy = REALM_KERBEROS_ALLOW_PERMITTED_LOGINS;
> 	} else if (g_strcmp0 (access, sssd_class->sssd_conf_provider_name) == 0) {
> 		policy = REALM_KERBEROS_ALLOW_REALM_LOGINS;
>@@ -360,12 +378,16 @@ update_login_policy (RealmSssd *self)
> 		policy = REALM_KERBEROS_POLICY_NOT_SET;
> 	}
> 
>-	g_ptr_array_add (permitted, NULL);
>+	g_ptr_array_add (permitted_logins, NULL);
>+	g_ptr_array_add (permitted_groups, NULL);
> 
> 	realm_kerberos_set_login_policy (kerberos, policy);
>-	realm_kerberos_set_permitted_logins (kerberos, (const gchar **)permitted->pdata);
>+	realm_kerberos_set_permitted_logins (kerberos, (const gchar **)permitted_logins->pdata);
>+	realm_kerberos_set_permitted_groups (kerberos, (const gchar **)permitted_groups->pdata);
> 
>-	g_ptr_array_free (permitted, TRUE);
>+	g_ptr_array_free (permitted_logins, TRUE);
>+	g_ptr_array_free (permitted_groups, TRUE);
>+	g_free (access);
> }
> 
> void
>diff --git a/service/realm-sssd.h b/service/realm-sssd.h
>index 42b9403..8d86e85 100644
>--- a/service/realm-sssd.h
>+++ b/service/realm-sssd.h
>@@ -72,6 +72,7 @@ gboolean            realm_sssd_set_login_policy         (RealmIniConfig *config,
>                                                          const gchar *access_provider,
>                                                          const gchar **add_names,
>                                                          const gchar **remove_names,
>+                                                         gboolean names_are_groups,
>                                                          GError **error);
> 
> void                realm_sssd_update_properties        (RealmSssd *self);
>diff --git a/tools/realm-discover.c b/tools/realm-discover.c
>index 326f8eb..cec3fd0 100644
>--- a/tools/realm-discover.c
>+++ b/tools/realm-discover.c
>@@ -104,6 +104,9 @@ print_realm_info (RealmClient *client,
> 			string = g_strjoinv (", ", (gchar **)realm_dbus_realm_get_permitted_logins (realm));
> 			g_print ("  permitted-logins: %s\n", string);
> 			g_free (string);
>+			string = g_strjoinv (", ", (gchar **)realm_dbus_realm_get_permitted_groups (realm));
>+			g_print ("  permitted-groups: %s\n", string);
>+			g_free (string);
> 		}
> 	}
> }
>diff --git a/tools/realm-logins.c b/tools/realm-logins.c
>index 0b10946..8276a57 100644
>--- a/tools/realm-logins.c
>+++ b/tools/realm-logins.c
>@@ -84,7 +84,8 @@ perform_permit_specific (RealmClient *client,
>                          const gchar *realm_name,
>                          const gchar **logins,
>                          gint n_logins,
>-                         gboolean withdraw)
>+                         gboolean withdraw,
>+                         gboolean names_are_groups)
> {
> 	RealmDbusRealm *realm;
> 	SyncClosure sync;
>@@ -104,7 +105,8 @@ perform_permit_specific (RealmClient *client,
> 	sync.result = NULL;
> 	sync.loop = g_main_loop_new (NULL, FALSE);
> 
>-	options = realm_build_options (NULL, NULL);
>+	options = realm_build_options ("groups", names_are_groups,
>+	                               NULL);
> 	g_variant_ref_sink (options);
> 
> 	realm_dbus_realm_call_change_login_policy (realm, REALM_DBUS_LOGIN_POLICY_PERMITTED,
>@@ -185,6 +187,7 @@ realm_permit_or_deny (RealmClient *client,
> {
> 	GOptionContext *context;
> 	gboolean arg_all = FALSE;
>+	gboolean arg_groups = FALSE;
> 	gboolean arg_withdraw = FALSE;
> 	gchar *realm_name = NULL;
> 	GError *error = NULL;
>@@ -197,6 +200,8 @@ realm_permit_or_deny (RealmClient *client,
> 		  permit ? N_("Permit any realm account login") : N_("Deny any realm account login"), NULL },
> 		{ "withdraw", 'x', 0, G_OPTION_ARG_NONE, &arg_withdraw,
> 		  N_("Withdraw permit for a realm account to login"), NULL },
>+		{ "groups", 'g', 0, G_OPTION_ARG_NONE, &arg_groups,
>+		  N_("Treat names as groups which to permit"), NULL },
> 		{ "realm", 'R', 0, G_OPTION_ARG_STRING, &realm_name, N_("Realm to permit/deny logins for"), NULL },
> 		{ NULL, }
> 	};
>@@ -219,6 +224,9 @@ realm_permit_or_deny (RealmClient *client,
> 	} else if (arg_all && arg_withdraw) {
> 		realm_print_error (_("Specific logins must be specified with --withdraw"));
> 
>+	} else if (arg_all && arg_groups) {
>+		realm_print_error (_("Groups may not be specified with -a or --all"));
>+
> 	} else if (arg_all) {
> 		ret = perform_logins_all (client, realm_name, permit);
> 
>@@ -236,7 +244,7 @@ realm_permit_or_deny (RealmClient *client,
> 
> 		ret = perform_permit_specific (client, realm_name,
> 		                               (const gchar **)(argv + 1),
>-		                               argc - 1, arg_withdraw);
>+		                               argc - 1, arg_withdraw, arg_groups);
> 	}
> 
> 	g_free (realm_name);
>diff --git a/tools/realm.c b/tools/realm.c
>index f5fead4..3d4e91e 100644
>--- a/tools/realm.c
>+++ b/tools/realm.c
>@@ -108,6 +108,7 @@ realm_build_options (const gchar *first,
>                      ...)
> {
> 	const gchar *value;
>+	gboolean bvalue;
> 	GPtrArray *opts;
> 	GVariant *options;
> 	GVariant *option;
>@@ -117,12 +118,18 @@ realm_build_options (const gchar *first,
> 
> 	opts = g_ptr_array_new ();
> 	while (first != NULL) {
>-		value = va_arg (va, const gchar *);
>-		if (value != NULL) {
>-			option = g_variant_new ("{sv}", first, g_variant_new_string (value));
>-			g_ptr_array_add (opts, option);
>+		option = NULL;
>+		if (g_str_equal (first, "groups")) {
>+			bvalue = va_arg (va, gboolean);
>+			option = g_variant_new ("{sv}", first, g_variant_new_boolean (bvalue));
>+		} else {
>+			value = va_arg (va, const gchar *);
>+			if (value != NULL)
>+				option = g_variant_new ("{sv}", first, g_variant_new_string (value));
> 		}
> 
>+		if (option)
>+			g_ptr_array_add (opts, option);
> 		first = va_arg (va, const gchar *);
> 	}
> 
>-- 
>1.8.1.4

Actions: View | Splinter Review

Attachments on bug 58397: 78779

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.