IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

caacl: fix incorrect construction of HbacRequest for hosts

Browse Source 
The _acl_make_request function is using the 'host/' prefix itself
instead of the hostname after it.  Use split_any_principal to do the
splitting correctly, also taking realm into account.

Reviewed-By: David Kupka <dkupka@redhat.com>
This commit is contained in:
Fraser Tweedale 2015-07-03 10:05:40 -04:00 committed by Tomas Babej
parent f13cce2d9c
commit e3c225317b
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ipalib/plugins/caacl.py
View File

@ -55,13 +55,15 @@ register = Registry()
def _acl_make_request(principal_type, principal, ca_ref, profile_id):
"""Construct HBAC request for the given principal, CA and profile"""
service, name, realm = split_any_principal(principal)
req = pyhbac.HbacRequest()
req.targethost.name = ca_ref
req.service.name = profile_id
if principal_type == 'user':
req.user.name = principal
elif principal_type == 'host':
req.user.name = principal[:5] # strip 'host/'
req.user.name = name
elif principal_type == 'service':
req.user.name = normalize_principal(principal)
groups = []
@ -70,8 +72,7 @@ def _acl_make_request(principal_type, principal, ca_ref, profile_id):
groups = user_obj.get('memberof_group', [])
groups += user_obj.get('memberofindirect_group', [])
elif principal_type == 'host':
service, hostname, realm = split_any_principal(principal)
host_obj = api.Command.host_show(hostname)['result']
host_obj = api.Command.host_show(name)['result']
groups = host_obj.get('memberof_hostgroup', [])
groups += host_obj.get('memberofindirect_hostgroup', [])
req.user.groups = sorted(set(groups))