providers/simple/simple_access.c

16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose/*
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose   SSSD
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose   Simple access control
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose   Copyright (C) Sumit Bose <sbose@redhat.com> 2010
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose   This program is free software; you can redistribute it and/or modify
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose   it under the terms of the GNU General Public License as published by
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose   the Free Software Foundation; either version 3 of the License, or
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose   (at your option) any later version.
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose   This program is distributed in the hope that it will be useful,
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose   but WITHOUT ANY WARRANTY; without even the implied warranty of
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose   GNU General Public License for more details.
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose   You should have received a copy of the GNU General Public License
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose   along with this program.  If not, see <http://www.gnu.org/licenses/>.
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose*/
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose#include <security/pam_modules.h>
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
225d845476b6136be9b77f528ed986bba7a7f732Simo Sorce#include "providers/simple/simple_access.h"
c777f575b0ec0c48ce3b85ea2c5cc298db02450eJakub Hrozek#include "providers/simple/simple_access_pvt.h"
c8119652b17229a5aca9b110365c310a6afdce30Jakub Hrozek#include "util/sss_utf8.h"
cc2d77d5218c188119fa954c856e858cbde76947Pavel Březina#include "providers/backend.h"
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose#include "db/sysdb.h"
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose#define CONFDB_SIMPLE_ALLOW_USERS "simple_allow_users"
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose#define CONFDB_SIMPLE_DENY_USERS "simple_deny_users"
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
1b474ef7011f4bf9ce4aac85dbc9827a9486d5ebStephen Gallagher#define CONFDB_SIMPLE_ALLOW_GROUPS "simple_allow_groups"
1b474ef7011f4bf9ce4aac85dbc9827a9486d5ebStephen Gallagher#define CONFDB_SIMPLE_DENY_GROUPS "simple_deny_groups"
1b474ef7011f4bf9ce4aac85dbc9827a9486d5ebStephen Gallagher
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl#define TIMEOUT_OF_REFRESH_FILTER_LISTS 5
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichlstatic errno_t simple_access_parse_names(TALLOC_CTX *mem_ctx,
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl                                         struct be_ctx *be_ctx,
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl                                         char **list,
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina                                         char ***_out)
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina{
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    TALLOC_CTX *tmp_ctx = NULL;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    char **out = NULL;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    size_t size;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    size_t i;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    errno_t ret;
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek    char *domname = NULL;
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek    char *shortname = NULL;
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek    struct sss_domain_info *domain;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    if (list == NULL) {
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        *_out = NULL;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        return EOK;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    }
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    tmp_ctx = talloc_new(NULL);
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    if (tmp_ctx == NULL) {
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        DEBUG(SSSDBG_CRIT_FAILURE, "talloc_new() failed\n");
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        ret = ENOMEM;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        goto done;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    }
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    for (size = 0; list[size] != NULL; size++) {
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        /* count size */
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    }
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    out = talloc_zero_array(tmp_ctx, char*, size + 1);
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    if (out == NULL) {
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        DEBUG(SSSDBG_CRIT_FAILURE, "talloc_zero_array() failed\n");
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        ret = ENOMEM;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        goto done;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    }
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    /* Since this is access provider, we should fail on any error so we don't
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina     * allow unauthorized access. */
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    for (i = 0; i < size; i++) {
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        ret = sss_parse_name(tmp_ctx, be_ctx->domain->names, list[i],
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek                             &domname, &shortname);
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        if (ret != EOK) {
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek            DEBUG(SSSDBG_OP_FAILURE, "sss_parse_name failed [%d]: %s\n",
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek                ret, sss_strerror(ret));
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina            goto done;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        }
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek        if (domname != NULL) {
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek            domain = find_domain_by_name(be_ctx->domain, domname, true);
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek            if (domain == NULL) {
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek                ret = ERR_DOMAIN_NOT_FOUND;
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek                goto done;
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek            }
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        } else {
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek            domain = be_ctx->domain;
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek        }
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek        out[i] = sss_create_internal_fqname(out, shortname, domain->name);
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek        if (out[i] == NULL) {
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek            ret = EIO;
eef359b508b898ae99d2bf292a43f0f295a2ba5eJakub Hrozek            goto done;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        }
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    }
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    *_out = talloc_steal(mem_ctx, out);
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    ret = EOK;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březinadone:
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    talloc_free(tmp_ctx);
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    return ret;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina}
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březinaint simple_access_obtain_filter_lists(struct simple_ctx *ctx)
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl{
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    struct be_ctx *bectx = ctx->be_ctx;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    int ret;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    int i;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    struct {
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl        const char *name;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl        const char *option;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl        char **orig_list;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl        char ***ctx_list;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    } lists[] = {{"Allow users", CONFDB_SIMPLE_ALLOW_USERS, NULL, NULL},
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl                 {"Deny users", CONFDB_SIMPLE_DENY_USERS, NULL, NULL},
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl                 {"Allow groups", CONFDB_SIMPLE_ALLOW_GROUPS, NULL, NULL},
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl                 {"Deny groups", CONFDB_SIMPLE_DENY_GROUPS, NULL, NULL},
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl                 {NULL, NULL, NULL, NULL}};
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    lists[0].ctx_list = &ctx->allow_users;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    lists[1].ctx_list = &ctx->deny_users;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    lists[2].ctx_list = &ctx->allow_groups;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    lists[3].ctx_list = &ctx->deny_groups;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    ret = sysdb_master_domain_update(bectx->domain);
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov        DEBUG(SSSDBG_FUNC_DATA, "Update of master domain failed [%d]: %s.\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov                                 ret, sss_strerror(ret));
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl        goto failed;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    }
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    for (i = 0; lists[i].name != NULL; i++) {
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl        ret = confdb_get_string_as_list(bectx->cdb, ctx, bectx->conf_path,
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl                                        lists[i].option, &lists[i].orig_list);
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl        if (ret == ENOENT) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov            DEBUG(SSSDBG_FUNC_DATA, "%s list is empty.\n", lists[i].name);
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl            *lists[i].ctx_list = NULL;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl            continue;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl        } else if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov            DEBUG(SSSDBG_CRIT_FAILURE, "confdb_get_string_as_list failed.\n");
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl            goto failed;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl        }
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl        ret = simple_access_parse_names(ctx, bectx, lists[i].orig_list,
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl                                        lists[i].ctx_list);
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl        if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov            DEBUG(SSSDBG_CRIT_FAILURE, "Unable to parse %s list [%d]: %s\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov                                        lists[i].name, ret, sss_strerror(ret));
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl            goto failed;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl        }
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    }
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    if (!ctx->allow_users &&
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl            !ctx->allow_groups &&
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl            !ctx->deny_users &&
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl            !ctx->deny_groups) {
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl        DEBUG(SSSDBG_OP_FAILURE,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov              "No rules supplied for simple access provider. "
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov               "Access will be granted for all users.\n");
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    }
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    return EOK;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichlfailed:
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    return ret;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl}
c0bca1722d6f9dfb654ad78397be70f79ff39af1Jakub Hrozek
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březinastruct simple_access_handler_state {
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose    struct pam_data *pd;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina};
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březinastatic void simple_access_handler_done(struct tevent_req *subreq);
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina
c777f575b0ec0c48ce3b85ea2c5cc298db02450eJakub Hrozekstruct tevent_req *
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březinasimple_access_handler_send(TALLOC_CTX *mem_ctx,
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina                           struct simple_ctx *simple_ctx,
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina                           struct pam_data *pd,
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina                           struct dp_req_params *params)
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina{
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    struct simple_access_handler_state *state;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    struct tevent_req *subreq;
c0bca1722d6f9dfb654ad78397be70f79ff39af1Jakub Hrozek    struct tevent_req *req;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    errno_t ret;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    time_t now;
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    req = tevent_req_create(mem_ctx, &state,
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina                            struct simple_access_handler_state);
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    if (req == NULL) {
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create() failed\n");
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        return NULL;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    }
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    state->pd = pd;
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    pd->pam_status = PAM_SYSTEM_ERR;
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose    if (pd->cmd != SSS_PAM_ACCT_MGMT) {
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl        DEBUG(SSSDBG_CONF_SETTINGS,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov              "simple access does not handle pam task %d.\n", pd->cmd);
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose        pd->pam_status = PAM_MODULE_UNKNOWN;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        goto immediately;
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose    }
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    now = time(NULL);
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    if ((now - simple_ctx->last_refresh_of_filter_lists)
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl        > TIMEOUT_OF_REFRESH_FILTER_LISTS) {
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        ret = simple_access_obtain_filter_lists(simple_ctx);
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl        if (ret != EOK) {
79ac0e8a4840202c3615d6ce6584df3c08efb594Jakub Hrozek            DEBUG(SSSDBG_CRIT_FAILURE,
79ac0e8a4840202c3615d6ce6584df3c08efb594Jakub Hrozek                  "Failed to refresh filter lists, denying all access\n");
79ac0e8a4840202c3615d6ce6584df3c08efb594Jakub Hrozek            pd->pam_status = PAM_PERM_DENIED;
79ac0e8a4840202c3615d6ce6584df3c08efb594Jakub Hrozek            goto immediately;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl        }
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        simple_ctx->last_refresh_of_filter_lists = now;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    }
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    subreq = simple_access_check_send(state, params->ev, simple_ctx, pd->user);
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    if (subreq == NULL) {
c0bca1722d6f9dfb654ad78397be70f79ff39af1Jakub Hrozek        pd->pam_status = PAM_SYSTEM_ERR;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        goto immediately;
c0bca1722d6f9dfb654ad78397be70f79ff39af1Jakub Hrozek    }
c0bca1722d6f9dfb654ad78397be70f79ff39af1Jakub Hrozek
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    tevent_req_set_callback(subreq, simple_access_handler_done, req);
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    return req;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březinaimmediately:
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    /* TODO For backward compatibility we always return EOK to DP now. */
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    tevent_req_done(req);
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    tevent_req_post(req, params->ev);
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    return req;
c0bca1722d6f9dfb654ad78397be70f79ff39af1Jakub Hrozek}
c0bca1722d6f9dfb654ad78397be70f79ff39af1Jakub Hrozek
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březinastatic void simple_access_handler_done(struct tevent_req *subreq)
c0bca1722d6f9dfb654ad78397be70f79ff39af1Jakub Hrozek{
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    struct simple_access_handler_state *state;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    struct tevent_req *req;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    bool access_granted;
c0bca1722d6f9dfb654ad78397be70f79ff39af1Jakub Hrozek    errno_t ret;
c0bca1722d6f9dfb654ad78397be70f79ff39af1Jakub Hrozek
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    req = tevent_req_callback_data(subreq, struct tevent_req);
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    state = tevent_req_data(req, struct simple_access_handler_state);
c0bca1722d6f9dfb654ad78397be70f79ff39af1Jakub Hrozek
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    ret = simple_access_check_recv(subreq, &access_granted);
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    talloc_free(subreq);
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose    if (ret != EOK) {
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        state->pd->pam_status = PAM_SYSTEM_ERR;
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose        goto done;
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose    }
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose    if (access_granted) {
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        state->pd->pam_status = PAM_SUCCESS;
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose    } else {
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        state->pd->pam_status = PAM_PERM_DENIED;
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose    }
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bosedone:
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    /* TODO For backward compatibility we always return EOK to DP now. */
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    tevent_req_done(req);
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose}
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
c777f575b0ec0c48ce3b85ea2c5cc298db02450eJakub Hrozekerrno_t
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březinasimple_access_handler_recv(TALLOC_CTX *mem_ctx,
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina                       struct tevent_req *req,
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina                       struct pam_data **_data)
ffb83ee934f6ea1d9077ab601530436eff2d20e4Pavel Březina{
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    struct simple_access_handler_state *state = NULL;
ffb83ee934f6ea1d9077ab601530436eff2d20e4Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    state = tevent_req_data(req, struct simple_access_handler_state);
ffb83ee934f6ea1d9077ab601530436eff2d20e4Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    TEVENT_REQ_RETURN_ON_ERROR(req);
ffb83ee934f6ea1d9077ab601530436eff2d20e4Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    *_data = talloc_steal(mem_ctx, state->pd);
ffb83ee934f6ea1d9077ab601530436eff2d20e4Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    return EOK;
ffb83ee934f6ea1d9077ab601530436eff2d20e4Pavel Březina}
ffb83ee934f6ea1d9077ab601530436eff2d20e4Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březinaerrno_t sssm_simple_access_init(TALLOC_CTX *mem_ctx,
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina                                struct be_ctx *be_ctx,
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina                                void *module_data,
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina                                struct dp_method *dp_methods)
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose{
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose    struct simple_ctx *ctx;
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson    int ret;
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson    int i;
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson    char *simple_list_values = NULL;
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson    const char *simple_access_lists[] = {CONFDB_SIMPLE_ALLOW_USERS,
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson                                         CONFDB_SIMPLE_DENY_USERS,
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson                                         CONFDB_SIMPLE_ALLOW_GROUPS,
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson                                         CONFDB_SIMPLE_DENY_GROUPS,
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson                                         NULL};
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    ctx = talloc_zero(mem_ctx, struct simple_ctx);
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose    if (ctx == NULL) {
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina        DEBUG(SSSDBG_CRIT_FAILURE, "talloc_zero() failed.\n");
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose        return ENOMEM;
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose    }
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson    for (i = 0; simple_access_lists[i] != NULL; i++) {
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson        ret = confdb_get_string(be_ctx->cdb, mem_ctx, be_ctx->conf_path,
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson                                simple_access_lists[i], NULL,
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson                                &simple_list_values);
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson        if (simple_list_values == NULL) {
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson            continue;
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson        } else if (ret != EOK) {
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson            DEBUG(SSSDBG_CRIT_FAILURE, "confdb_get_string failed.\n");
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson            return ret;
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson        }
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson        DEBUG(SSSDBG_CONF_SETTINGS, "%s values: [%s]\n",
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson                                     simple_access_lists[i],
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson                                     simple_list_values);
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson    }
e32e17d04c796b37bc3f4cde58106d54ffa2b6d1Justin Stephenson
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    ctx->domain = be_ctx->domain;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    ctx->be_ctx = be_ctx;
a620742bffad5ef92597b6a25401f6d5c217afa9Pavel Reichl    ctx->last_refresh_of_filter_lists = 0;
1b474ef7011f4bf9ce4aac85dbc9827a9486d5ebStephen Gallagher
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina    dp_set_method(dp_methods, DPM_ACCESS_HANDLER,
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina                  simple_access_handler_send, simple_access_handler_recv, ctx,
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina                  struct simple_ctx, struct pam_data, struct pam_data *);
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose    return EOK;
16ac0d6e148b1e07e579d47de1da7ac541447bd2Sumit Bose}