From afe6fd2743c00bc85ae892be0db657e1f7f320ff Mon Sep 17 00:00:00 2001
From: Stef Walter <stefw@redhat.com>
Date: Thu, 2 May 2013 14:27:34 +0200
Subject: [PATCH] Add support for permitting logins by group

https://bugs.freedesktop.org/show_bug.cgi?id=58397
---
 dbus/org.freedesktop.realmd.xml | 15 ++++++++++
 doc/manual/realm.xml            |  6 ++++
 service/realm-example.c         |  1 +
 service/realm-kerberos.c        | 10 ++++++-
 service/realm-kerberos.h        |  4 +++
 service/realm-samba.c           |  1 +
 service/realm-sssd-ad.c         |  2 +-
 service/realm-sssd-ipa.c        |  2 +-
 service/realm-sssd.c            | 62 ++++++++++++++++++++++++++++-------------
 service/realm-sssd.h            |  1 +
 tools/realm-discover.c          |  3 ++
 tools/realm-logins.c            | 14 ++++++++--
 tools/realm.c                   | 15 +++++++---
 13 files changed, 106 insertions(+), 30 deletions(-)

diff --git a/dbus/org.freedesktop.realmd.xml b/dbus/org.freedesktop.realmd.xml
index dee0895..6bf63d7 100644
--- a/dbus/org.freedesktop.realmd.xml
+++ b/dbus/org.freedesktop.realmd.xml
@@ -411,6 +411,17 @@
 		<property name="PermittedLogins" type="as" access="read"/>
 
 		<!--
+		  PermittedGroups: the permitted group names
+
+		  The list of groups which users need to be in to be allowed
+		  to log into this computer. This is only relevant if the
+		  #org.freedesktop.realmd.Realm:LoginPolicy property
+		  contains the <literal>allow-permitted-logins</literal>
+		  string.
+		-->
+		<property name="PermittedGroups" type="as" access="read"/>
+
+		<!--
 		  ChangeLoginPolicy:
 		  @login_policy: the new login policy, or an empty string
 		  @permitted_add: a list of logins to permit
@@ -436,6 +447,10 @@
 		      identifier chosen by the client, which can then later be
 		      passed to org.freedesktop.realmd.Service.Cancel() in order
 		      to cancel the operation</para></listitem>
+		    <listitem><para><literal>groups</literal>: boolean which if
+		    set to <literal>TRUE</literal> means that the names in
+		    @permitted_add and @permitted_remove are group names instead
+		    of login names.</para></listitem>
 		  </itemizedlist>
 
 		  This method requires authorization for the PolicyKit action
diff --git a/doc/manual/realm.xml b/doc/manual/realm.xml
index f882ca6..29b70b4 100644
--- a/doc/manual/realm.xml
+++ b/doc/manual/realm.xml
@@ -344,6 +344,12 @@ $ realm permit --withdraw DOMAIN\User
 			in.</para></listitem>
 		</varlistentry>
 		<varlistentry>
+			<term><option>--groups, -g</option></term>
+			<listitem><para>Treat the specified names as groups
+			rather than user login names. Permit login by users in
+			the specified groups.</para></listitem>
+		</varlistentry>
+		<varlistentry>
 			<term><option>--realm, -R</option></term>
 			<listitem><para>Specify the of the realm to change login
 			policy for.</para></listitem>
diff --git a/service/realm-example.c b/service/realm-example.c
index a67c06b..627b346 100644
--- a/service/realm-example.c
+++ b/service/realm-example.c
@@ -326,6 +326,7 @@ realm_example_logins_async (RealmKerberos *realm,
                             RealmKerberosLoginPolicy login_policy,
                             const gchar **add,
                             const gchar **remove,
+                            GVariant *options,
                             GAsyncReadyCallback callback,
                             gpointer user_data)
 {
diff --git a/service/realm-kerberos.c b/service/realm-kerberos.c
index 439172a..116d853 100644
--- a/service/realm-kerberos.c
+++ b/service/realm-kerberos.c
@@ -485,7 +485,7 @@ handle_change_login_policy (RealmDbusRealm *realm,
 	g_return_val_if_fail (klass->logins_async != NULL, FALSE);
 
 	(klass->logins_async) (self, invocation, policy, (const gchar **)add,
-	                       (const gchar **)remove, on_logins_complete,
+	                       (const gchar **)remove, options, on_logins_complete,
 	                       method_closure_new (self, invocation));
 
 	return TRUE;
@@ -821,6 +821,14 @@ realm_kerberos_set_permitted_logins (RealmKerberos *self,
 	realm_dbus_realm_set_permitted_logins (self->pv->realm_iface, (const gchar * const*)value);
 }
 
+void
+realm_kerberos_set_permitted_groups (RealmKerberos *self,
+                                     const gchar **value)
+{
+	g_return_if_fail (REALM_IS_KERBEROS (self));
+	realm_dbus_realm_set_permitted_groups (self->pv->realm_iface, (const gchar * const*)value);
+}
+
 const gchar *
 realm_kerberos_login_policy_to_string (RealmKerberosLoginPolicy value)
 {
diff --git a/service/realm-kerberos.h b/service/realm-kerberos.h
index 0274779..241aefe 100644
--- a/service/realm-kerberos.h
+++ b/service/realm-kerberos.h
@@ -58,6 +58,7 @@ struct _RealmKerberosClass {
 	                                         RealmKerberosLoginPolicy login_policy,
 	                                         const gchar **permitted_add,
 	                                         const gchar **permitted_remove,
+	                                         GVariant *options,
 	                                         GAsyncReadyCallback callback,
 	                                         gpointer user_data);
 
@@ -101,6 +102,9 @@ void                realm_kerberos_set_suggested_admin         (RealmKerberos *s
 void                realm_kerberos_set_permitted_logins        (RealmKerberos *self,
                                                                 const gchar **value);
 
+void                realm_kerberos_set_permitted_groups        (RealmKerberos *self,
+                                                                const gchar **value);
+
 void                realm_kerberos_set_login_policy            (RealmKerberos *self,
                                                                 RealmKerberosLoginPolicy value);
 
diff --git a/service/realm-samba.c b/service/realm-samba.c
index 3f0b8b0..e795255 100644
--- a/service/realm-samba.c
+++ b/service/realm-samba.c
@@ -472,6 +472,7 @@ realm_samba_logins_async (RealmKerberos *realm,
                           RealmKerberosLoginPolicy login_policy,
                           const gchar **add,
                           const gchar **remove,
+                          GVariant *options,
                           GAsyncReadyCallback callback,
                           gpointer user_data)
 {
diff --git a/service/realm-sssd-ad.c b/service/realm-sssd-ad.c
index 272c134..69f232d 100644
--- a/service/realm-sssd-ad.c
+++ b/service/realm-sssd-ad.c
@@ -191,7 +191,7 @@ configure_sssd_for_domain (RealmIniConfig *config,
 		else
 			access_provider = "simple";
 		section = realm_sssd_config_domain_to_section (disco->workgroup);
-		ret = realm_sssd_set_login_policy (config, section, access_provider, NULL, NULL, error);
+		ret = realm_sssd_set_login_policy (config, section, access_provider, NULL, NULL, FALSE, error);
 		free (section);
 	}
 
diff --git a/service/realm-sssd-ipa.c b/service/realm-sssd-ipa.c
index 2d1bb0c..1a34587 100644
--- a/service/realm-sssd-ipa.c
+++ b/service/realm-sssd-ipa.c
@@ -212,7 +212,7 @@ on_ipa_client_do_restart (GObject *source,
 		else
 			access_provider = "simple";
 		section = realm_sssd_config_domain_to_section (domain);
-		realm_sssd_set_login_policy (config, section, access_provider, NULL, NULL, &error);
+		realm_sssd_set_login_policy (config, section, access_provider, NULL, NULL, FALSE, &error);
 		free (section);
 	}
 
diff --git a/service/realm-sssd.c b/service/realm-sssd.c
index 8af2039..da3d553 100644
--- a/service/realm-sssd.c
+++ b/service/realm-sssd.c
@@ -76,8 +76,10 @@ realm_sssd_set_login_policy (RealmIniConfig *config,
                              const gchar *access_provider,
                              const gchar **add_names,
                              const gchar **remove_names,
+                             gboolean names_are_groups,
                              GError **error)
 {
+	const gchar *field = names_are_groups ? "simple_allow_groups" : "simple_allow_users";
 	gchar *allow;
 
 	if (!realm_ini_config_begin_change (config, error))
@@ -85,14 +87,13 @@ realm_sssd_set_login_policy (RealmIniConfig *config,
 
 	if (access_provider)
 		realm_ini_config_set (config, section, "access_provider", access_provider, NULL);
-	realm_ini_config_set_list_diff (config, section, "simple_allow_users", ",",
-	                                add_names, remove_names);
+	realm_ini_config_set_list_diff (config, section, field, ",", add_names, remove_names);
 
 	/*
 	 * HACK: Work around for sssd problem where it allows users if
 	 * simple_allow_users is empty. Set it to a dollar in this case.
 	 */
-	allow = realm_ini_config_get (config, section, "simple_allow_users");
+	allow = realm_ini_config_get (config, section, field);
 	if (allow != NULL) {
 		g_strstrip (allow);
 		if (g_str_equal (allow, "") || g_str_equal (allow, "$") || g_str_equal (allow, ",")) {
@@ -103,9 +104,9 @@ realm_sssd_set_login_policy (RealmIniConfig *config,
 
 	if (allow == NULL) {
 		if (g_str_equal (access_provider, "simple"))
-			realm_ini_config_set (config, section, "simple_allow_users", "$", NULL);
+			realm_ini_config_set (config, section, field, "$", NULL);
 		else
-			realm_ini_config_set (config, section, "simple_allow_users", NULL, NULL);
+			realm_ini_config_set (config, section, field, NULL, NULL);
 	}
 
 	g_free (allow);
@@ -114,7 +115,7 @@ realm_sssd_set_login_policy (RealmIniConfig *config,
 }
 
 static gboolean
-sssd_config_check_login_list (gchar **logins,
+sssd_config_check_login_list (const gchar **logins,
                               GError **error)
 {
 	#define INVALID_CHARS ",$"
@@ -139,11 +140,13 @@ realm_sssd_logins_async (RealmKerberos *realm,
                          RealmKerberosLoginPolicy login_policy,
                          const gchar **add,
                          const gchar **remove,
+                         GVariant *options,
                          GAsyncReadyCallback callback,
                          gpointer user_data)
 {
 	RealmSssdClass *sssd_class = REALM_SSSD_GET_CLASS (realm);
 	RealmSssd *self = REALM_SSSD (realm);
+	gboolean names_are_groups = FALSE;
 	EggTask *task;
 	gchar **remove_names = NULL;
 	gchar **add_names = NULL;
@@ -179,21 +182,28 @@ realm_sssd_logins_async (RealmKerberos *realm,
 		g_return_if_reached ();
 	}
 
-	add_names = realm_kerberos_parse_logins (realm, TRUE, add, &error);
-	if (add_names != NULL)
-		remove_names = realm_kerberos_parse_logins (realm, TRUE, remove, &error);
+	if (!g_variant_lookup (options, "groups", "b", &names_are_groups))
+		names_are_groups = FALSE;
+
+	if (!names_are_groups) {
+		add_names = realm_kerberos_parse_logins (realm, TRUE, add, &error);
+		if (add_names != NULL)
+			remove_names = realm_kerberos_parse_logins (realm, TRUE, remove, &error);
+		add = (const gchar **)add_names;
+		remove = (const gchar **)remove_names;
+	}
 
 	if (error == NULL)
-	    sssd_config_check_login_list (add_names, &error);
+		sssd_config_check_login_list (add, &error);
 	if (error == NULL)
-	    sssd_config_check_login_list (remove_names, &error);
+		sssd_config_check_login_list (remove, &error);
 
 	if (error == NULL) {
 		realm_sssd_set_login_policy (self->pv->config,
 		                             self->pv->section,
 		                             access_provider,
-		                             (const gchar **)add_names,
-		                             (const gchar **)remove_names,
+		                             add, remove,
+		                             names_are_groups,
 		                             &error);
 	}
 
@@ -332,12 +342,14 @@ update_login_policy (RealmSssd *self)
 	RealmSssdClass *sssd_class = REALM_SSSD_GET_CLASS (self);
 	RealmKerberosLoginPolicy policy = REALM_KERBEROS_POLICY_NOT_SET;
 	RealmKerberos *kerberos = REALM_KERBEROS (self);
-	GPtrArray *permitted;
+	GPtrArray *permitted_logins;
+	GPtrArray *permitted_groups;
 	gchar *access = NULL;
 	gchar **values;
 	gint i;
 
-	permitted = g_ptr_array_new_full (0, g_free);
+	permitted_logins = g_ptr_array_new_full (0, g_free);
+	permitted_groups = g_ptr_array_new_full (0, g_free);
 	if (self->pv->section != NULL)
 		access = realm_ini_config_get (self->pv->config, self->pv->section, "access_provider");
 	if (g_strcmp0 (access, "simple") == 0) {
@@ -345,10 +357,16 @@ update_login_policy (RealmSssd *self)
 		                                    "simple_allow_users", ",");
 		for (i = 0; values != NULL && values[i] != NULL; i++) {
 			if (!g_str_equal (values[i], "") && !g_str_equal (values[i], "$"))
-				g_ptr_array_add (permitted, realm_kerberos_format_login (kerberos, values[i]));
+				g_ptr_array_add (permitted_logins, realm_kerberos_format_login (kerberos, values[i]));
+		}
+		g_strfreev (values);
+		values = realm_ini_config_get_list (self->pv->config, self->pv->section,
+		                                    "simple_allow_groups", ",");
+		for (i = 0; values != NULL && values[i] != NULL; i++) {
+			if (!g_str_equal (values[i], "") && !g_str_equal (values[i], "$"))
+				g_ptr_array_add (permitted_groups, g_strdup (values[i]));
 		}
 		g_strfreev (values);
-		g_free (access);
 		policy = REALM_KERBEROS_ALLOW_PERMITTED_LOGINS;
 	} else if (g_strcmp0 (access, sssd_class->sssd_conf_provider_name) == 0) {
 		policy = REALM_KERBEROS_ALLOW_REALM_LOGINS;
@@ -360,12 +378,16 @@ update_login_policy (RealmSssd *self)
 		policy = REALM_KERBEROS_POLICY_NOT_SET;
 	}
 
-	g_ptr_array_add (permitted, NULL);
+	g_ptr_array_add (permitted_logins, NULL);
+	g_ptr_array_add (permitted_groups, NULL);
 
 	realm_kerberos_set_login_policy (kerberos, policy);
-	realm_kerberos_set_permitted_logins (kerberos, (const gchar **)permitted->pdata);
+	realm_kerberos_set_permitted_logins (kerberos, (const gchar **)permitted_logins->pdata);
+	realm_kerberos_set_permitted_groups (kerberos, (const gchar **)permitted_groups->pdata);
 
-	g_ptr_array_free (permitted, TRUE);
+	g_ptr_array_free (permitted_logins, TRUE);
+	g_ptr_array_free (permitted_groups, TRUE);
+	g_free (access);
 }
 
 void
diff --git a/service/realm-sssd.h b/service/realm-sssd.h
index 42b9403..8d86e85 100644
--- a/service/realm-sssd.h
+++ b/service/realm-sssd.h
@@ -72,6 +72,7 @@ gboolean            realm_sssd_set_login_policy         (RealmIniConfig *config,
                                                          const gchar *access_provider,
                                                          const gchar **add_names,
                                                          const gchar **remove_names,
+                                                         gboolean names_are_groups,
                                                          GError **error);
 
 void                realm_sssd_update_properties        (RealmSssd *self);
diff --git a/tools/realm-discover.c b/tools/realm-discover.c
index 326f8eb..cec3fd0 100644
--- a/tools/realm-discover.c
+++ b/tools/realm-discover.c
@@ -104,6 +104,9 @@ print_realm_info (RealmClient *client,
 			string = g_strjoinv (", ", (gchar **)realm_dbus_realm_get_permitted_logins (realm));
 			g_print ("  permitted-logins: %s\n", string);
 			g_free (string);
+			string = g_strjoinv (", ", (gchar **)realm_dbus_realm_get_permitted_groups (realm));
+			g_print ("  permitted-groups: %s\n", string);
+			g_free (string);
 		}
 	}
 }
diff --git a/tools/realm-logins.c b/tools/realm-logins.c
index 0b10946..8276a57 100644
--- a/tools/realm-logins.c
+++ b/tools/realm-logins.c
@@ -84,7 +84,8 @@ perform_permit_specific (RealmClient *client,
                          const gchar *realm_name,
                          const gchar **logins,
                          gint n_logins,
-                         gboolean withdraw)
+                         gboolean withdraw,
+                         gboolean names_are_groups)
 {
 	RealmDbusRealm *realm;
 	SyncClosure sync;
@@ -104,7 +105,8 @@ perform_permit_specific (RealmClient *client,
 	sync.result = NULL;
 	sync.loop = g_main_loop_new (NULL, FALSE);
 
-	options = realm_build_options (NULL, NULL);
+	options = realm_build_options ("groups", names_are_groups,
+	                               NULL);
 	g_variant_ref_sink (options);
 
 	realm_dbus_realm_call_change_login_policy (realm, REALM_DBUS_LOGIN_POLICY_PERMITTED,
@@ -185,6 +187,7 @@ realm_permit_or_deny (RealmClient *client,
 {
 	GOptionContext *context;
 	gboolean arg_all = FALSE;
+	gboolean arg_groups = FALSE;
 	gboolean arg_withdraw = FALSE;
 	gchar *realm_name = NULL;
 	GError *error = NULL;
@@ -197,6 +200,8 @@ realm_permit_or_deny (RealmClient *client,
 		  permit ? N_("Permit any realm account login") : N_("Deny any realm account login"), NULL },
 		{ "withdraw", 'x', 0, G_OPTION_ARG_NONE, &arg_withdraw,
 		  N_("Withdraw permit for a realm account to login"), NULL },
+		{ "groups", 'g', 0, G_OPTION_ARG_NONE, &arg_groups,
+		  N_("Treat names as groups which to permit"), NULL },
 		{ "realm", 'R', 0, G_OPTION_ARG_STRING, &realm_name, N_("Realm to permit/deny logins for"), NULL },
 		{ NULL, }
 	};
@@ -219,6 +224,9 @@ realm_permit_or_deny (RealmClient *client,
 	} else if (arg_all && arg_withdraw) {
 		realm_print_error (_("Specific logins must be specified with --withdraw"));
 
+	} else if (arg_all && arg_groups) {
+		realm_print_error (_("Groups may not be specified with -a or --all"));
+
 	} else if (arg_all) {
 		ret = perform_logins_all (client, realm_name, permit);
 
@@ -236,7 +244,7 @@ realm_permit_or_deny (RealmClient *client,
 
 		ret = perform_permit_specific (client, realm_name,
 		                               (const gchar **)(argv + 1),
-		                               argc - 1, arg_withdraw);
+		                               argc - 1, arg_withdraw, arg_groups);
 	}
 
 	g_free (realm_name);
diff --git a/tools/realm.c b/tools/realm.c
index f5fead4..3d4e91e 100644
--- a/tools/realm.c
+++ b/tools/realm.c
@@ -108,6 +108,7 @@ realm_build_options (const gchar *first,
                      ...)
 {
 	const gchar *value;
+	gboolean bvalue;
 	GPtrArray *opts;
 	GVariant *options;
 	GVariant *option;
@@ -117,12 +118,18 @@ realm_build_options (const gchar *first,
 
 	opts = g_ptr_array_new ();
 	while (first != NULL) {
-		value = va_arg (va, const gchar *);
-		if (value != NULL) {
-			option = g_variant_new ("{sv}", first, g_variant_new_string (value));
-			g_ptr_array_add (opts, option);
+		option = NULL;
+		if (g_str_equal (first, "groups")) {
+			bvalue = va_arg (va, gboolean);
+			option = g_variant_new ("{sv}", first, g_variant_new_boolean (bvalue));
+		} else {
+			value = va_arg (va, const gchar *);
+			if (value != NULL)
+				option = g_variant_new ("{sv}", first, g_variant_new_string (value));
 		}
 
+		if (option)
+			g_ptr_array_add (opts, option);
 		first = va_arg (va, const gchar *);
 	}
 
-- 
1.8.1.4