Projects/Local authorization pluggable interface - Revision history

Ghudson: Projects/Local authentication pluggable interface moved to Projects/Local authorization pluggable interface

2013-08-16T18:06:25Z

Projects/Local authentication pluggable interface moved to Projects/Local authorization pluggable interface

Ghudson at 15:43, 1 July 2013

2013-07-01T15:43:19Z

Ghudson: /* Commits */

2013-03-14T21:11:19Z

‎Commits

Ghudson at 21:10, 14 March 2013

2013-03-14T21:10:51Z

Ghudson: /* Mailing list discussions */

2013-02-27T19:51:41Z

‎Mailing list discussions

Ghudson at 19:51, 27 February 2013

2013-02-27T19:51:26Z

Ghudson at 19:50, 27 February 2013

2013-02-27T19:50:27Z

Ghudson at 15:34, 16 February 2013

2013-02-16T15:34:18Z

Ghudson at 15:33, 16 February 2013

2013-02-16T15:33:44Z

Ghudson at 17:54, 15 February 2013

2013-02-15T17:54:13Z

@@ Line 41: / Line 41: @@
 an2ln_types is optional.  If it is set, it contains a null-terminated array of uppercase string constants which act as type names.  As krb5_aname_to_localname processes the auth_to_local values in the profile, any values with type strings matching a string in an2ln_types will result in calls to the an2ln method, with the residual string (or NULL if there is none) as an argument.  The method should return 0 and set *lname_out if it can translate the principal, KRB5_LNAME_NOTRANS if it cannot, and any other error code on a serious failure.  The an2ln method will be invoked multiple times if multiple auth_to_local values reference its types, if it returns KRB5_LNAME_NOTRANS on prior invocations.
-If an2ln types is not set, but the an2ln method is implemented, the module's an2ln method will be consulted for all krb5_aname_to_localname operations, with type and residual set to NULL.  If multiple modules implement an2ln without setting an2ln_types, the order in which they are consulted is not defined, except that all such modules will be consulted before the built-in mechanisms.
+If an2ln types is not set, but the an2ln method is implemented, the module's an2ln method will be consulted for all krb5_aname_to_localname operations, with type and residual set to NULL.
 The free_string method will be used to return any local names returned by the an2ln methods.  It is mandatory if an2ln is implemented.

@@ Line 70: / Line 70: @@
 ==Commits==
 fb5b0e0abb80a3ccd8251abddc18435d81f3 Add localauth pluggable interface
-b8696b1ed70ffebbeee7142f1e5e086d75ce4e30 Add tests for localauth interface
+    b8696b1ed70ffebbeee7142f1e5e086d75ce4e30 Add tests for localauth interface
 aec0626fffea5d7e060979c2a4dc9555beae96a Document localauth interface
-ec217570e20d4702be2830235bad56184d47b1d2 Remove stray include in localauth_plugin.h
+    ec217570e20d4702be2830235bad56184d47b1d2 Remove stray include in localauth_plugin.h
 ==Release notes==

@@ Line 1: / Line 1: @@
-{{project-approved}}
+{{project-rel|1.12}}
 ==Description==
@@ Line 67: / Line 67: @@
 * http://mailman.mit.edu/pipermail/krbdev/2013-January/011414.html
 * http://mailman.mit.edu/pipermail/krbdev/2013-February/011421.html
 ==Release notes==

@@ Line 66: / Line 66: @@
 ==Mailing list discussions==
-http://mailman.mit.edu/pipermail/krbdev/2013-January/011414.html
+* http://mailman.mit.edu/pipermail/krbdev/2013-January/011414.html
-http://mailman.mit.edu/pipermail/krbdev/2013-February/011421.html
+* http://mailman.mit.edu/pipermail/krbdev/2013-February/011421.html
 ==Release notes==

← Older revision		Revision as of 19:51, 27 February 2013
Line 63:		Line 63:

	A new page under doc/plugindev will document the pluggable interface. krb5_conf.rst will be amended to briefly describe the interface.		A new page under doc/plugindev will document the pluggable interface. krb5_conf.rst will be amended to briefly describe the interface.
		+
		+	==Mailing list discussions==
		+
		+	http://mailman.mit.edu/pipermail/krbdev/2013-January/011414.html
		+	http://mailman.mit.edu/pipermail/krbdev/2013-February/011421.html

	==Release notes==		==Release notes==

← Older revision	Revision as of 18:06, 16 August 2013
(No difference)

← Older revision		Revision as of 19:50, 27 February 2013
Line 1:		Line 1:
−	{{project-~~review\|2012-02-08~~}}	+	{{project-approved}}
	{{project-target\|1.12}}		{{project-target\|1.12}}

@@ Line 25: / Line 25: @@
 Since both operations are about the relationship of krb5 principals to local accounts, a single pluggable interface allows modules to affect either operation or both of them.
-The pluggable interface will have four methods (plus initialization and finalization methods):
+The pluggable interface will have three methods (plus initialization and finalization methods):
     krb5_error_code (*userok)(krb5_context context, krb5_localauth_moddata data,

@@ Line 28: / Line 28: @@
     krb5_error_code (*userok)(krb5_context context, krb5_localauth_moddata data,
-                              krb5_const_principal princ, const char *lname);
+                              krb5_const_principal aname, const char *lname);
     const char **an2ln_types;
     krb5_error_code (*an2ln)(krb5_context context, krb5_localauth_moddata data,
                              const char *type, const char *residual,
-                             krb5_const_principal princ, char **lname_out);
+                             krb5_const_principal aname, char **lname_out);
     void (*free_string)(krb5_context context, krb5_localauth_moddata data,

@@ Line 40: / Line 40: @@
 The userok method is optional.  If it is implemented, it will be invoked for krb5_kuserok operations.  It should return 0 if authorization is allowed, EPERM if authorization is authoritatively denied, KRB5_PLUGIN_NO_HANDLE if the module cannot determine whether authorization is allowed, and any other error code on a serious failure.  krb5_kuserok will return true if at least one module returns success and all other modules return success or KRB5_PLUGIN_NO_HANDLE.  If any module returns EPERM or another error, remaining modules will be skipped and krb5_kuserok will return false.
-an2ln_types is optional.  If it is set, it contains a null-terminated array of uppercase string constants which act as type names.  As krb5_aname_to_localname processes the auth_to_local values in the profile, any values with type strings matching a string in an2ln_types will result in calls to the an2ln method, with the residual string (or NULL if there is none) as an argument.  The method should return 0 and set *lname_out if it can translate the principal, KRB5_PLUGIN_NO_HANDLE if it cannot, and any other error code on a serious failure.  The an2ln method will be invoked multiple times if multiple auth_to_local values reference its types, if it returns KRB5_PLUGIN_NO_HANDLE on prior invocations.
+an2ln_types is optional.  If it is set, it contains a null-terminated array of uppercase string constants which act as type names.  As krb5_aname_to_localname processes the auth_to_local values in the profile, any values with type strings matching a string in an2ln_types will result in calls to the an2ln method, with the residual string (or NULL if there is none) as an argument.  The method should return 0 and set *lname_out if it can translate the principal, KRB5_LNAME_NOTRANS if it cannot, and any other error code on a serious failure.  The an2ln method will be invoked multiple times if multiple auth_to_local values reference its types, if it returns KRB5_LNAME_NOTRANS on prior invocations.
 If an2ln types is not set, but the an2ln method is implemented, the module's an2ln method will be consulted for all krb5_aname_to_localname operations, with type and residual set to NULL.  If multiple modules implement an2ln without setting an2ln_types, the order in which they are consulted is not defined, except that all such modules will be consulted before the built-in mechanisms.
@@ Line 54: / Line 54: @@
 * A module which implements a parameterized operation for auth_to_local processing, such as database support or an augmented version of rule processing.  An administrator might register multiple modules of this type, and might invoke a module multiple times with different parameters.  A module of this type would set one or more an2ln_types values.
-* A module which wants to delegate all aname-to-lname processing to another system facility such as sssd.  Most likely it would be unnecessary to register more than one module of this type, but the interface leaves open the possibility for a module to override only a segment of the principal namespace and return KRB5_PLUGIN_NO_HANDLE for other principals.  A module of this type would leave an2ln_types as NULL.
+* A module which wants to delegate all aname-to-lname processing to another system facility such as sssd.  Most likely it would be unnecessary to register more than one module of this type, but the interface leaves open the possibility for a module to override only a segment of the principal namespace and return KRB5_LNAME_NOTRANS for other principals.  A module of this type would leave an2ln_types as NULL.
 ==Testing==