summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAlexander Bokovoy <abokovoy@redhat.com>2011-09-12 17:23:56 +0300
committerRob Crittenden <rcritten@redhat.com>2011-09-11 21:08:43 -0400
commit452863dcbaf1a82b0a879e3a2f3e58ffa1803c2f (patch)
treedf056427c76ed0f08e86e3f183729b7f02736a9b
parente638ba9d7f091ef9aeba5747fc872348671205bd (diff)
downloadfreeipa-452863dcbaf1a82b0a879e3a2f3e58ffa1803c2f.zip
freeipa-452863dcbaf1a82b0a879e3a2f3e58ffa1803c2f.tar.gz
freeipa-452863dcbaf1a82b0a879e3a2f3e58ffa1803c2f.tar.xz
Unroll groups when testing HBAC rules
Fixes https://fedorahosted.org/freeipa/ticket/1740
-rw-r--r--ipalib/plugins/hbactest.py39
1 files changed, 34 insertions, 5 deletions
diff --git a/ipalib/plugins/hbactest.py b/ipalib/plugins/hbactest.py
index d007845..5fce2e5 100644
--- a/ipalib/plugins/hbactest.py
+++ b/ipalib/plugins/hbactest.py
@@ -255,12 +255,41 @@ class hbactest(Command):
'error': testrules, 'matched': None, 'notmatched': None,
'value' : False}
- # Rules are converted to pyhbac format, we can test them
+ # Rules are converted to pyhbac format, build request and then test it
request = pyhbac.HbacRequest()
- request.user.name = options['user']
- request.service.name = options['service']
- request.srchost.name = options['sourcehost']
- request.targethost.name = options['targethost']
+
+ if options['user'] != u'all':
+ try:
+ request.user.name = options['user']
+ request.user.groups = self.api.Command.user_show(request.user.name)['result']['memberof_group']
+ except:
+ pass
+
+ if options['service'] != u'all':
+ try:
+ request.service.name = options['service']
+ request.service.groups = \
+ self.api.Command.hbacsvcgroup_show(request.service.name)['result']['member_hbacsvc']
+ except:
+ pass
+
+ if options['sourcehost'] != u'all':
+ try:
+ request.srchost.name = options['sourcehost']
+ srchost_result = self.api.Command.host_show(request.srchost.name)['result']
+ srchost_groups = srchost_result['memberof_hostgroup']
+ request.srchost.groups = sorted(set(srchost_groups))
+ except:
+ pass
+
+ if options['targethost'] != u'all':
+ try:
+ request.targethost.name = options['targethost']
+ tgthost_result = self.api.Command.host_show(request.targethost.name)['result']
+ tgthost_groups = tgthost_result['memberof_hostgroup']
+ request.targethost.groups = sorted(set(tgthost_groups))
+ except:
+ pass
matched_rules = []
notmatched_rules = []