effcbdb12c7ef892f1fd92a745cb33a08ca4ba30Stephen Gallagher

effcbdb12c7ef892f1fd92a745cb33a08ca4ba30Stephen Gallagher#include <security/pam_modules.h>

effcbdb12c7ef892f1fd92a745cb33a08ca4ba30Stephen Gallagher

effcbdb12c7ef892f1fd92a745cb33a08ca4ba30Stephen Gallagher#include "providers/simple/simple_access.h"

effcbdb12c7ef892f1fd92a745cb33a08ca4ba30Stephen Gallagher#include "util/sss_utf8.h"

74e95cfd9d3939dfe9417d79d2f6fc79b361405fJakub Hrozek#include "providers/dp_backend.h"

effcbdb12c7ef892f1fd92a745cb33a08ca4ba30Stephen Gallagher#include "db/sysdb.h"

55d80b1301fe969fb4ba2b9481027887b9462dbbJakub Hrozek

55d80b1301fe969fb4ba2b9481027887b9462dbbJakub Hrozek#define CONFDB_SIMPLE_ALLOW_USERS "simple_allow_users"

55d80b1301fe969fb4ba2b9481027887b9462dbbJakub Hrozek#define CONFDB_SIMPLE_DENY_USERS "simple_deny_users"

55d80b1301fe969fb4ba2b9481027887b9462dbbJakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek#define CONFDB_SIMPLE_ALLOW_GROUPS "simple_allow_groups"

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek#define CONFDB_SIMPLE_DENY_GROUPS "simple_deny_groups"

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozekstatic void simple_access_check(struct tevent_req *req);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozekvoid simple_access_handler(struct be_req *be_req)

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek{

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek struct be_ctx *be_ctx = be_req_get_be_ctx(be_req);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek struct pam_data *pd;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek struct tevent_req *req;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek struct simple_ctx *ctx;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek pd = talloc_get_type(be_req_get_data(be_req), struct pam_data);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek pd->pam_status = PAM_SYSTEM_ERR;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek if (pd->cmd != SSS_PAM_ACCT_MGMT) {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek DEBUG(4, ("simple access does not handles pam task %d.\n", pd->cmd));

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek pd->pam_status = PAM_MODULE_UNKNOWN;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek goto done;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek }

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek ctx = talloc_get_type(be_ctx->bet_info[BET_ACCESS].pvt_bet_data,

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek struct simple_ctx);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek req = simple_access_check_send(be_req, be_ctx->ev, ctx, pd->user);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek if (!req) {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek pd->pam_status = PAM_SYSTEM_ERR;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek goto done;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek }

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek tevent_req_set_callback(req, simple_access_check, be_req);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek return;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozekdone:

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek be_req_terminate(be_req, DP_ERR_OK, pd->pam_status, NULL);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek}

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozekstatic void simple_access_check(struct tevent_req *req)

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek{

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek bool access_granted = false;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek errno_t ret;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek struct pam_data *pd;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek struct be_req *be_req;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek be_req = tevent_req_callback_data(req, struct be_req);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek pd = talloc_get_type(be_req_get_data(be_req), struct pam_data);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek ret = simple_access_check_recv(req, &access_granted);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek talloc_free(req);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek if (ret != EOK) {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek pd->pam_status = PAM_SYSTEM_ERR;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek goto done;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek }

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek if (access_granted) {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek pd->pam_status = PAM_SUCCESS;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek } else {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek pd->pam_status = PAM_PERM_DENIED;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek }

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozekdone:

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek be_req_terminate(be_req, DP_ERR_OK, pd->pam_status, NULL);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek}

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozekstatic errno_t simple_access_parse_names(TALLOC_CTX *mem_ctx,

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek struct be_ctx *be_ctx,

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek char **list,

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek char ***_out)

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek{

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek TALLOC_CTX *tmp_ctx = NULL;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek char **out = NULL;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek char *domain = NULL;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek char *name = NULL;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek size_t size;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek size_t i;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek errno_t ret;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek if (list == NULL) {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek *_out = NULL;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek return EOK;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek }

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek tmp_ctx = talloc_new(NULL);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek if (tmp_ctx == NULL) {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, ("talloc_new() failed\n"));

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek ret = ENOMEM;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek goto done;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek }

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek for (size = 0; list[size] != NULL; size++) {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek /* count size */

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek }

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek out = talloc_zero_array(tmp_ctx, char*, size + 1);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek if (out == NULL) {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, ("talloc_zero_array() failed\n"));

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek ret = ENOMEM;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek goto done;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek }

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek /* Since this is access provider, we should fail on any error so we don't

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek for (i = 0; i < size; i++) {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek ret = sss_parse_name(tmp_ctx, be_ctx->domain->names, list[i],

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek &domain, &name);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek if (ret != EOK) {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, ("Unable to parse name '%s' [%d]: %s\n",

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek list[i], ret, sss_strerror(ret)));

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek goto done;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek }

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek if (domain == NULL || strcasecmp(domain, be_ctx->domain->name) == 0) {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek /* This object belongs to main SSSD domain. Those users and groups

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek out[i] = talloc_move(out, &name);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek } else {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek /* Subdomain users and groups are stored as fully qualified names,

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek out[i] = talloc_move(out, &list[i]);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek }

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek }

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek *_out = talloc_steal(mem_ctx, out);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek ret = EOK;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozekdone:

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek talloc_free(tmp_ctx);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek return ret;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek}

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozekstruct bet_ops simple_access_ops = {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek .handler = simple_access_handler,

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek .finalize = NULL

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek};

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozekint sssm_simple_access_init(struct be_ctx *bectx, struct bet_ops **ops,

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek void **pvt_data)

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek{

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek int ret = EINVAL;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek struct simple_ctx *ctx;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek int i;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek struct {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek const char *name;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek const char *option;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek char **orig_list;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek char ***ctx_list;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek } lists[] = {{"Allow users", CONFDB_SIMPLE_ALLOW_USERS, NULL, NULL},

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek {"Deny users", CONFDB_SIMPLE_DENY_USERS, NULL, NULL},

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek {"Allow groups", CONFDB_SIMPLE_ALLOW_GROUPS, NULL, NULL},

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek {"Deny groups", CONFDB_SIMPLE_DENY_GROUPS, NULL, NULL},

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek {NULL, NULL, NULL, NULL}};

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek ctx = talloc_zero(bectx, struct simple_ctx);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek if (ctx == NULL) {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, ("talloc_zero failed.\n"));

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek return ENOMEM;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek }

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek ctx->domain = bectx->domain;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek ctx->be_ctx = bectx;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek lists[0].ctx_list = &ctx->allow_users;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek lists[1].ctx_list = &ctx->deny_users;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek lists[2].ctx_list = &ctx->allow_groups;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek lists[3].ctx_list = &ctx->deny_groups;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek for (i = 0; lists[i].name != NULL; i++) {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek ret = confdb_get_string_as_list(bectx->cdb, ctx, bectx->conf_path,

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek lists[i].option, &lists[i].orig_list);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek if (ret == ENOENT) {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek DEBUG(SSSDBG_FUNC_DATA, ("%s list is empty.\n", lists[i].name));

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek *lists[i].ctx_list = NULL;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek continue;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek } else if (ret != EOK) {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, ("confdb_get_string_as_list failed.\n"));

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek goto failed;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek }

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek ret = simple_access_parse_names(ctx, bectx, lists[i].orig_list,

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek lists[i].ctx_list);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek if (ret != EOK) {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, ("Unable to parse %s list [%d]: %s\n",

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek lists[i].name, ret, sss_strerror(ret)));

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek goto failed;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek }

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek }

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek if (!ctx->allow_users &&

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek !ctx->allow_groups &&

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek !ctx->deny_users &&

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek !ctx->deny_groups) {

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, ("No rules supplied for simple access provider. "

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek "Access will be granted for all users.\n"));

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek }

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek *ops = &simple_access_ops;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek *pvt_data = ctx;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek return EOK;

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozekfailed:

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek talloc_free(ctx);

ebc6ab564dc2a0a2b08c42d727fc403dde4a2dc9Jakub Hrozek return ret;

effcbdb12c7ef892f1fd92a745cb33a08ca4ba30Stephen Gallagher}

effcbdb12c7ef892f1fd92a745cb33a08ca4ba30Stephen Gallagher