Libipa_hbac provides a mechanism to validate FreeIPA HBAC rules as well as evaluate whether they apply to a particular user login attempt.
More...
|
enum | hbac_debug_level { , HBAC_DBG_ERROR,
HBAC_DBG_WARNING,
HBAC_DBG_INFO,
HBAC_DBG_TRACE
} |
| Debug levels for HBAC. More...
|
|
enum | hbac_eval_result { HBAC_EVAL_ERROR = -1,
HBAC_EVAL_ALLOW,
HBAC_EVAL_DENY,
HBAC_EVAL_OOM
} |
| Result of HBAC evaluation. More...
|
|
enum | hbac_error_code {
HBAC_ERROR_UNKNOWN = -1,
HBAC_SUCCESS,
HBAC_ERROR_NOT_IMPLEMENTED,
HBAC_ERROR_OUT_OF_MEMORY,
HBAC_ERROR_UNPARSEABLE_RULE
} |
| Error code returned by the evaluator. More...
|
|
Libipa_hbac provides a mechanism to validate FreeIPA HBAC rules as well as evaluate whether they apply to a particular user login attempt.
Libipa_hbac is case-insensitive and compatible with UTF-8.
HBAC uses external_debug_fn for logging messages.
- Parameters
-
[in] | external_debug_fn | Pointer to external logging function. |
Debug levels for HBAC.
Enumerator |
---|
HBAC_DBG_ERROR |
Fatal failure (not used).
|
HBAC_DBG_WARNING |
Serious failure (out of memory, for example).
|
HBAC_DBG_INFO |
Warnings (not used).
|
HBAC_DBG_TRACE |
HBAC allow/disallow info.
Verbose description of rules.
|
Error code returned by the evaluator.
Enumerator |
---|
HBAC_ERROR_UNKNOWN |
Unexpected error.
|
HBAC_SUCCESS |
Successful evaluation.
|
HBAC_ERROR_NOT_IMPLEMENTED |
Function is not yet implemented.
|
HBAC_ERROR_OUT_OF_MEMORY |
Ran out of memory during processing.
|
HBAC_ERROR_UNPARSEABLE_RULE |
Parse error while evaluating rule.
|
Result of HBAC evaluation.
Enumerator |
---|
HBAC_EVAL_ERROR |
An error occurred See the hbac_info for more details.
|
HBAC_EVAL_ALLOW |
Evaluation grants access.
|
HBAC_EVAL_DENY |
Evaluation denies access.
|
HBAC_EVAL_OOM |
Evaluation failed due to lack of memory hbac_info is not available.
|
Display error description.
- Parameters
-
- Returns
- English string describing the error
Evaluate an authorization request against a set of HBAC rules.
- Parameters
-
[in] | rules | A NULL-terminated list of rules to evaluate against |
[in] | hbac_req | A user authorization request |
[out] | info | Extended information (including the name of the rule that allowed access (or caused a parse error) |
- Returns
-
void hbac_free_info |
( |
struct hbac_info * |
info | ) |
|
Display result of hbac evaluation in human-readable form.
- Parameters
-
- Returns
- English string describing the evaluation result
bool hbac_rule_is_complete |
( |
struct hbac_rule * |
rule, |
|
|
uint32_t * |
missing_attrs |
|
) |
| |
Evaluate whether an HBAC rule contains all necessary elements.
- Parameters
-
- Returns
- True if the rule contains all mandatory attributes
- Note
- This function does not care if the rule is enabled or disabled