[PATCH] allowed_shells: using wildcard for any shell

[Denis Kutin]

Dear friends,

Using sssd, for a long time, I have come across with a problem recently,
which I would like to solve with your help.

I provide centralized authentication and authorization service for a huge
heterogeneous network. And in my case it would be "nice and easy" if sssd
used only shells(5). I believe this mechanism is sufficient for
identification of an allowed shell.

I take a liberty to offer you this tiny patch, which will let use wildcard
(*) in param allowed_shells in sssd.conf

What do you think about it?

-- 
Denis Kutin

[Dmitri Pal]

On 01/30/2014 05:35 AM, Denis Kutin wrote:
>  Dear friends, 
>
>  Using sssd, for a long time, I have come across with a problem
>  recently, which I would like to solve with your help.
>
>  I provide centralized authentication and authorization service for a
>  huge heterogeneous network. And in my case it would be "nice and easy"
>  if sssd used only shells(5). I believe this mechanism is sufficient
>  for identification of an allowed shell.
>
>  I take a liberty to offer you this tiny patch, which will let use
>  wildcard (*) in param allowed_shells in sssd.conf
>
>  What do you think about it?
>
>  -- 
>  Denis Kutin
>
>
>  _______________________________________________
>  sssd-devel mailing list
>  sssd-devel(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/sssd-devel 

Thanks for the patch.
But let us start from the beginning. I see the problem that you want to
solve so please file ticket so that we can track it for future.

I am not an expert in the code but:
1) The check is inside the loop, it probably should be outside the loop
(not sure)
2) Debug message should be different because we want to differentiate
from allowed but does not exist.
3) We are saying that we are using user shall but actually returning
shall_fallback, is that right?

-- 
be Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/

[Jakub Hrozek]

On Thu, Jan 30, 2014 at 02:35:57PM +0400, Denis Kutin wrote:
>  Dear friends,
>  
>  Using sssd, for a long time, I have come across with a problem recently,
>  which I would like to solve with your help.
>  
>  I provide centralized authentication and authorization service for a huge
>  heterogeneous network. And in my case it would be "nice and easy" if sssd
>  used only shells(5). I believe this mechanism is sufficient for
>  identification of an allowed shell.
>  
>  I take a liberty to offer you this tiny patch, which will let use wildcard
>  (*) in param allowed_shells in sssd.conf
>  
>  What do you think about it? 
Hi,

the patch itself looks OK except for lines being over 80 characters,
but I don't think I understand the use case well. If a user has a shell
specified that is outside /etc/shells he's kicked out anyway. If he does,
he's permitted by default..

[Pavel Reichl]

On 01/30/2014 11:35 AM, Denis Kutin wrote:
>  Dear friends,
>
>  Using sssd, for a long time, I have come across with a problem 
>  recently, which I would like to solve with your help.
>
>  I provide centralized authentication and authorization service for a 
>  huge heterogeneous network. And in my case it would be "nice and easy" 
>  if sssd used only shells(5). I believe this mechanism is sufficient 
>  for identification of an allowed shell.
>
>  I take a liberty to offer you this tiny patch, which will let use 
>  wildcard (*) in param allowed_shells in sssd.conf
>
>  What do you think about it?
>
>  -- 
>  Denis Kutin
>
>
>  _______________________________________________
>  sssd-devel mailing list
>  sssd-devel(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/sssd-devel 
Hello Denis,

You patch seems to generally solve the problem. But there are some minor 
nitpicks with it:
* it needs rebasing (update debug message format)
* move check out of loop
* do not make lines longer then 80 chars
* probably document your use case would be helpful

Are you willing to do the changes?
If you are too busy I can do the changes myself. You would still keep 
the authorship of the patch. I would be just named in Signed-off-by tag. 
Would that work for you?

Thanks again for the patch!

[Pavel Reichl]

On 10/06/2014 11:20 AM, Pavel Reichl wrote:
>  On 01/30/2014 11:35 AM, Denis Kutin wrote:
> > Dear friends,
> >
> > Using sssd, for a long time, I have come across with a problem 
> > recently, which I would like to solve with your help.
> >
> > I provide centralized authentication and authorization service for a 
> > huge heterogeneous network. And in my case it would be "nice and 
> > easy" if sssd used only shells(5). I believe this mechanism is 
> > sufficient for identification of an allowed shell.
> >
> > I take a liberty to offer you this tiny patch, which will let use 
> > wildcard (*) in param allowed_shells in sssd.conf
> >
> > What do you think about it?
> >
> > -- 
> > Denis Kutin
> >
> >
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel(a)lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>  Hello Denis,
>
>  You patch seems to generally solve the problem. But there are some 
>  minor nitpicks with it:
>  * it needs rebasing (update debug message format)
>  * move check out of loop
>  * do not make lines longer then 80 chars
>  * probably document your use case would be helpful
>
>  Are you willing to do the changes?
>  If you are too busy I can do the changes myself. You would still keep 
>  the authorship of the patch. I would be just named in Signed-off-by 
>  tag. Would that work for you?
>
>  Thanks again for the patch!
>
>
>  _______________________________________________
>  sssd-devel mailing list
>  sssd-devel(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/sssd-devel 
Hello,

I took the liberty and prepared the patch.

Thanks.

[Jakub Hrozek]

On Fri, Oct 10, 2014 at 02:09:03PM +0200, Pavel Reichl wrote:
>  
>  On 10/06/2014 11:20 AM, Pavel Reichl wrote:
>  >
>  >On 01/30/2014 11:35 AM, Denis Kutin wrote:
>  >>Dear friends,
>  >>
>  >>Using sssd, for a long time, I have come across with a problem recently,
>  >>which I would like to solve with your help.
>  >>
>  >>I provide centralized authentication and authorization service for a
>  >>huge heterogeneous network. And in my case it would be "nice and easy"
>  >>if sssd used only shells(5). I believe this mechanism is sufficient for
>  >>identification of an allowed shell.
>  >>
>  >>I take a liberty to offer you this tiny patch, which will let use
>  >>wildcard (*) in param allowed_shells in sssd.conf
>  >>
>  >>What do you think about it?
>  >>
>  >>-- 
>  >>Denis Kutin
>  >>
>  >>
>  >>_______________________________________________
>  >>sssd-devel mailing list
>  >>sssd-devel(a)lists.fedorahosted.org
>  >>https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>  >Hello Denis,
>  >
>  >You patch seems to generally solve the problem. But there are some minor
>  >nitpicks with it:
>  >* it needs rebasing (update debug message format)
>  >* move check out of loop
>  >* do not make lines longer then 80 chars
>  >* probably document your use case would be helpful
>  >
>  >Are you willing to do the changes?
>  >If you are too busy I can do the changes myself. You would still keep the
>  >authorship of the patch. I would be just named in Signed-off-by tag. Would
>  >that work for you?
>  >
>  >Thanks again for the patch!
>  >
>  >
>  >_______________________________________________
>  >sssd-devel mailing list
>  >sssd-devel(a)lists.fedorahosted.org
>  >https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>  Hello,
>  
>  I took the liberty and prepared the patch.
>  
>  Thanks. 
Looks good to me, just specified a wrong ticket in the commit message. I
can fix that before pushing.

Otherwise ACK.

[Jakub Hrozek]

On Wed, Oct 22, 2014 at 04:15:23PM +0200, Jakub Hrozek wrote:
>  On Fri, Oct 10, 2014 at 02:09:03PM +0200, Pavel Reichl wrote:
>  > 
>  > On 10/06/2014 11:20 AM, Pavel Reichl wrote:
>  > >
>  > >On 01/30/2014 11:35 AM, Denis Kutin wrote:
>  > >>Dear friends,
>  > >>
>  > >>Using sssd, for a long time, I have come across with a problem recently,
>  > >>which I would like to solve with your help.
>  > >>
>  > >>I provide centralized authentication and authorization service for a
>  > >>huge heterogeneous network. And in my case it would be "nice and
> easy"
>  > >>if sssd used only shells(5). I believe this mechanism is sufficient for
>  > >>identification of an allowed shell.
>  > >>
>  > >>I take a liberty to offer you this tiny patch, which will let use
>  > >>wildcard (*) in param allowed_shells in sssd.conf
>  > >>
>  > >>What do you think about it?
>  > >>
>  > >>-- 
>  > >>Denis Kutin
>  > >>
>  > >>
>  > >>_______________________________________________
>  > >>sssd-devel mailing list
>  > >>sssd-devel(a)lists.fedorahosted.org
>  > >>https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>  > >Hello Denis,
>  > >
>  > >You patch seems to generally solve the problem. But there are some minor
>  > >nitpicks with it:
>  > >* it needs rebasing (update debug message format)
>  > >* move check out of loop
>  > >* do not make lines longer then 80 chars
>  > >* probably document your use case would be helpful
>  > >
>  > >Are you willing to do the changes?
>  > >If you are too busy I can do the changes myself. You would still keep the
>  > >authorship of the patch. I would be just named in Signed-off-by tag. Would
>  > >that work for you?
>  > >
>  > >Thanks again for the patch!
>  > >
>  > >
>  > >_______________________________________________
>  > >sssd-devel mailing list
>  > >sssd-devel(a)lists.fedorahosted.org
>  > >https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>  > Hello,
>  > 
>  > I took the liberty and prepared the patch.
>  > 
>  > Thanks.
>  
>  Looks good to me, just specified a wrong ticket in the commit message. I
>  can fix that before pushing.
>  
>  Otherwise ACK. 
* master: e88d426def412c0dde83e15fe17cdf374ee70166