Hi fellow developers,
while working on https://fedorahosted.org/freeipa/ticket/4263 I found
some inconsistencies in the attribute naming:
There are the following attributes in the schema:
* ipasudorunas_user : RunAs Users
* ipasudorunas_group : Groups of RunAs Users (and not groups you can
RunAsGroup as)
This implies that ipasudorunas prefix implicitly talks about RunAsUser
and not RunAsGroup. This hypothesis is confirmed by attribute:
* ipasudorunasgroup_group : Run with the gid of a specified POSIX group
since here the prefix is ipasudorunas*group*.
However,
* ipasudorunasextuser : RunAs External User (consistent)
* ipasudorunasextgroup : RunAs External Group (*inconsistent*, since
ipasudorunas prefix means RunAsUser in other attributes. This attribute
naming implies semantics of "External Groups of RunAs Users" and not
"External group you can RunAsGroup as.").
The ticket https://fedorahosted.org/freeipa/ticket/4263 calls for
implementation of precisely this "External Groups of RunAs Users". Since
ipasudorunasextgroup attribute is taken, we have the following alternatives:
1.) Create new attribute ipasudorunasgroup_extgroup and move semantics
of ipasudorunasextgroup there. This frees ipasudorunasextgroup for the
4263's use case. (painful)
2.) Create new attribute with incosistent name, such as
ipasudorunasextgroupmembers or ipasudorunasextusergroup.
3.) Do not create new attributes, but use a workaround which adds failed
groups as users with % prefix (patch attached).
What do you think?
--
Tomas Babej
Associate Software Engineer | Red Hat | Identity Management
RHCE | Brno Site | IRC: tbabej | freeipa.org
>From 67a1908ef2c6eeab382eb435ad4d41536e7d98e3 Mon Sep 17 00:00:00 2001
From: Tomas Babej <tba...@redhat.com>
Date: Mon, 5 May 2014 17:04:27 +0200
Subject: [PATCH] sudorules: Allow specifing RunAsUser as external group
---
ipalib/plugins/sudorule.py | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/ipalib/plugins/sudorule.py b/ipalib/plugins/sudorule.py
index 627b4b975f6336658eb74d37b4c15d803511c5d4..68fd6d4748b63a2f2e436f1e7dabe42699fac787 100644
--- a/ipalib/plugins/sudorule.py
+++ b/ipalib/plugins/sudorule.py
@@ -550,6 +550,26 @@ class sudorule_remove_host(LDAPRemoveMember):
api.register(sudorule_remove_host)
+
+def convert_failed_groups_to_users_with_group_prefix(memberattr, failed):
+ """
+ Converts any failed groups to failed users by appending % character
+ to the group name.
+ """
+
+ # Basic assumptions
+ if not memberattr in failed:
+ return
+
+ if 'user' not in failed[memberattr] or 'group' not in failed[memberattr]:
+ return
+
+ for group_name, error in failed[memberattr]['group']:
+ failed[memberattr]['user'].append((u'%' + group_name, error))
+
+ failed[memberattr]['group'] = []
+
+
class sudorule_add_runasuser(LDAPAddMember):
__doc__ = _('Add users and groups for Sudo to execute as.')
@@ -589,6 +609,7 @@ class sudorule_add_runasuser(LDAPAddMember):
def post_callback(self, ldap, completed, failed, dn, entry_attrs, *keys, **options):
assert isinstance(dn, DN)
+ convert_failed_groups_to_users_with_group_prefix('ipasudorunas', failed)
return add_external_post_callback('ipasudorunas', 'user', 'ipasudorunasextuser', ldap, completed, failed, dn, entry_attrs, keys, options)
api.register(sudorule_add_runasuser)
@@ -602,6 +623,7 @@ class sudorule_remove_runasuser(LDAPRemoveMember):
def post_callback(self, ldap, completed, failed, dn, entry_attrs, *keys, **options):
assert isinstance(dn, DN)
+ convert_failed_groups_to_users_with_group_prefix('ipasudorunas', failed)
return remove_external_post_callback('ipasudorunas', 'user', 'ipasudorunasextuser', ldap, completed, failed, dn, entry_attrs, keys, options)
api.register(sudorule_remove_runasuser)
--
1.8.5.3
_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
