diff options
Diffstat (limited to 'src/providers/ipa/ipa_access.c')
| -rw-r--r-- | src/providers/ipa/ipa_access.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/src/providers/ipa/ipa_access.c b/src/providers/ipa/ipa_access.c index 2a6588eb..d88673f1 100644 --- a/src/providers/ipa/ipa_access.c +++ b/src/providers/ipa/ipa_access.c @@ -97,6 +97,7 @@ void ipa_access_handler(struct be_req *be_req) { struct pam_data *pd; struct hbac_ctx *hbac_ctx; + const char *deny_method; int pam_status = PAM_SYSTEM_ERR; struct ipa_access_ctx *ipa_access_ctx; int ret; @@ -108,7 +109,7 @@ void ipa_access_handler(struct be_req *be_req) DEBUG(1, ("talloc failed.\n")); goto fail; } - hbac_ctx->get_deny_rules = true; /* make this a config option */ + hbac_ctx->be_req = be_req; hbac_ctx->pd = pd; ipa_access_ctx = talloc_get_type( @@ -125,6 +126,14 @@ void ipa_access_handler(struct be_req *be_req) goto fail; } + deny_method = dp_opt_get_string(hbac_ctx->ipa_options, + IPA_HBAC_DENY_METHOD); + if (strcasecmp(deny_method, "IGNORE") == 0) { + hbac_ctx->get_deny_rules = false; + } else { + hbac_ctx->get_deny_rules = true; + } + ret = hbac_retry(hbac_ctx); if (ret != EOK) { goto fail; |