Libipa_hbac provides a mechanism to validate FreeIPA HBAC rules as well as evaluate whether they apply to a particular user login attempt.
More...
|
#define | HBAC_CATEGORY_NULL 0x0000 |
| No service category specified.
|
|
#define | HBAC_CATEGORY_ALL 0x0001 |
| Rule should apply to all.
|
|
#define | HBAC_RULE_ELEMENT_USERS 0x01 |
| User element.
|
|
#define | HBAC_RULE_ELEMENT_SERVICES 0x02 |
| Service element.
|
|
#define | HBAC_RULE_ELEMENT_TARGETHOSTS 0x04 |
| Target host element.
|
|
#define | HBAC_RULE_ELEMENT_SOURCEHOSTS 0x08 |
| Source host element.
|
|
|
typedef void(* | hbac_debug_fn_t) (const char *file, int line, const char *function, enum hbac_debug_level, const char *format,...) HBAC_ATTRIBUTE_PRINTF(5 |
| Function pointer to HBAC external debugging function.
|
|
typedef void(*) voi | hbac_enable_debug) (hbac_debug_fn_t external_debug_fn) |
| HBAC uses external_debug_fn for logging messages.
|
|
Libipa_hbac provides a mechanism to validate FreeIPA HBAC rules as well as evaluate whether they apply to a particular user login attempt.
Libipa_hbac is case-insensitive and compatible with UTF-8.
◆ hbac_enable_debug
HBAC uses external_debug_fn for logging messages.
- Parameters
-
[in] | external_debug_fn | Pointer to external logging function. |
◆ hbac_debug_level
Debug levels for HBAC.
Enumerator |
---|
HBAC_DBG_ERROR | Fatal failure (not used).
|
HBAC_DBG_WARNING | Serious failure (out of memory, for example).
|
HBAC_DBG_INFO | Warnings (not used).
|
HBAC_DBG_TRACE | HBAC allow/disallow info.
Verbose description of rules.
|
◆ hbac_error_code
Error code returned by the evaluator.
Enumerator |
---|
HBAC_ERROR_UNKNOWN | Unexpected error.
|
HBAC_SUCCESS | Successful evaluation.
|
HBAC_ERROR_NOT_IMPLEMENTED | Function is not yet implemented.
|
HBAC_ERROR_OUT_OF_MEMORY | Ran out of memory during processing.
|
HBAC_ERROR_UNPARSEABLE_RULE | Parse error while evaluating rule.
|
◆ hbac_eval_result
Result of HBAC evaluation.
Enumerator |
---|
HBAC_EVAL_ERROR | An error occurred See the hbac_info for more details.
|
HBAC_EVAL_ALLOW | Evaluation grants access.
|
HBAC_EVAL_DENY | Evaluation denies access.
|
HBAC_EVAL_OOM | Evaluation failed due to lack of memory hbac_info is not available.
|
◆ hbac_error_string()
Display error description.
- Parameters
-
- Returns
- English string describing the error
◆ hbac_evaluate()
Evaluate an authorization request against a set of HBAC rules.
- Parameters
-
[in] | rules | A NULL-terminated list of rules to evaluate against |
[in] | hbac_req | A user authorization request |
[out] | info | Extended information (including the name of the rule that allowed access (or caused a parse error) |
- Returns
-
◆ hbac_free_info()
void hbac_free_info |
( |
struct hbac_info * |
info | ) |
|
◆ hbac_result_string()
Display result of hbac evaluation in human-readable form.
- Parameters
-
- Returns
- English string describing the evaluation result
◆ hbac_rule_is_complete()
bool hbac_rule_is_complete |
( |
struct hbac_rule * |
rule, |
|
|
uint32_t * |
missing_attrs |
|
) |
| |
Evaluate whether an HBAC rule contains all necessary elements.
- Parameters
-
- Returns
- True if the rule contains all mandatory attributes
- Note
- This function does not care if the rule is enabled or disabled