Host-Based Access Control Resolver

Libipa_hbac provides a mechanism to validate FreeIPA HBAC rules as well as evaluate whether they apply to a particular user login attempt. More...

Data Structures

struct  hbac_rule_element
 Component of an HBAC rule. More...
struct  hbac_rule
 HBAC rule object for evaluation. More...
struct  hbac_request_element
 Component of an HBAC request. More...
struct  hbac_eval_req
 Request object for an HBAC rule evaluation. More...
struct  hbac_info
 Extended information. More...

Defines

#define HBAC_CATEGORY_NULL   0x0000
 No service category specified.
#define HBAC_CATEGORY_ALL   0x0001
 Rule should apply to all.
#define HBAC_RULE_ELEMENT_USERS   0x01
 User element.
#define HBAC_RULE_ELEMENT_SERVICES   0x02
 Service element.
#define HBAC_RULE_ELEMENT_TARGETHOSTS   0x04
 Target host element.
#define HBAC_RULE_ELEMENT_SOURCEHOSTS   0x08
 Source host element.

Enumerations

enum  hbac_eval_result { HBAC_EVAL_ERROR = -1, HBAC_EVAL_ALLOW, HBAC_EVAL_DENY, HBAC_EVAL_OOM }
 

Result of HBAC evaluation.

More...
enum  hbac_error_code {
  HBAC_ERROR_UNKNOWN = -1, HBAC_SUCCESS, HBAC_ERROR_NOT_IMPLEMENTED, HBAC_ERROR_OUT_OF_MEMORY,
  HBAC_ERROR_UNPARSEABLE_RULE
}
 

Error code returned by the evaluator.

More...

Functions

enum hbac_eval_result hbac_evaluate (struct hbac_rule **rules, struct hbac_eval_req *hbac_req, struct hbac_info **info)
 Evaluate an authorization request against a set of HBAC rules.
const char * hbac_result_string (enum hbac_eval_result result)
 Display result of hbac evaluation in human-readable form.
const char * hbac_error_string (enum hbac_error_code code)
 Display error description.
void hbac_free_info (struct hbac_info *info)
 Function to safely free hbac_info returned by hbac_evaluate.
bool hbac_rule_is_complete (struct hbac_rule *rule, uint32_t *missing_attrs)
 Evaluate whether an HBAC rule contains all necessary elements.

Detailed Description

Libipa_hbac provides a mechanism to validate FreeIPA HBAC rules as well as evaluate whether they apply to a particular user login attempt.

Libipa_hbac is case-insensitive and compatible with UTF-8.


Enumeration Type Documentation

Error code returned by the evaluator.

Enumerator:
HBAC_ERROR_UNKNOWN 

Unexpected error.

HBAC_SUCCESS 

Successful evaluation.

HBAC_ERROR_NOT_IMPLEMENTED 

Function is not yet implemented.

HBAC_ERROR_OUT_OF_MEMORY 

Ran out of memory during processing.

HBAC_ERROR_UNPARSEABLE_RULE 

Parse error while evaluating rule.

Result of HBAC evaluation.

Enumerator:
HBAC_EVAL_ERROR 

An error occurred See the hbac_info for more details.

HBAC_EVAL_ALLOW 

Evaluation grants access.

HBAC_EVAL_DENY 

Evaluation denies access.

HBAC_EVAL_OOM 

Evaluation failed due to lack of memory hbac_info is not available.


Function Documentation

const char* hbac_error_string ( enum hbac_error_code  code  ) 

Display error description.

Parameters:
code Error code returned in hbac_info
Returns:
English string describing the error
enum hbac_eval_result hbac_evaluate ( struct hbac_rule **  rules,
struct hbac_eval_req hbac_req,
struct hbac_info **  info 
)

Evaluate an authorization request against a set of HBAC rules.

Parameters:
[in] rules A NULL-terminated list of rules to evaluate against
[in] hbac_req A user authorization request
[out] info Extended information (including the name of the rule that allowed access (or caused a parse error)
Returns:
void hbac_free_info ( struct hbac_info info  ) 

Function to safely free hbac_info returned by hbac_evaluate.

Parameters:
info hbac_info returned by hbac_evaluate
const char* hbac_result_string ( enum hbac_eval_result  result  ) 

Display result of hbac evaluation in human-readable form.

Parameters:
[in] result Return value of hbac_evaluate
Returns:
English string describing the evaluation result
bool hbac_rule_is_complete ( struct hbac_rule rule,
uint32_t *  missing_attrs 
)

Evaluate whether an HBAC rule contains all necessary elements.

Parameters:
[in] rule An HBAC rule to evaluate
[out] missing_attrs A list of attributes missing from the rule This is a bitmask that may contain one or more of HBAC_RULE_ELEMENT_USERS, HBAC_RULE_ELEMENT_SERVICES, HBAC_RULE_ELEMENT_TARGETHOSTS and HBAC_RULE_ELEMENT_SOURCEHOSTS
Returns:
True if the rule contains all mandatory attributes
Note:
This function does not care if the rule is enabled or disabled

Generated on 23 Feb 2017 for ipa_hbac by  doxygen 1.6.1