Libipa_hbac provides a mechanism to validate FreeIPA HBAC rules as well as evaluate whether they apply to a particular user login attempt.
More...
|
enum | hbac_debug_level { , HBAC_DBG_ERROR,
HBAC_DBG_WARNING,
HBAC_DBG_INFO,
HBAC_DBG_TRACE
} |
| Debug levels for HBAC. More...
|
|
enum | hbac_eval_result { HBAC_EVAL_ERROR = -1,
HBAC_EVAL_ALLOW,
HBAC_EVAL_DENY,
HBAC_EVAL_OOM
} |
| Result of HBAC evaluation. More...
|
|
enum | hbac_error_code {
HBAC_ERROR_UNKNOWN = -1,
HBAC_SUCCESS,
HBAC_ERROR_NOT_IMPLEMENTED,
HBAC_ERROR_OUT_OF_MEMORY,
HBAC_ERROR_UNPARSEABLE_RULE
} |
| Error code returned by the evaluator. More...
|
|
Libipa_hbac provides a mechanism to validate FreeIPA HBAC rules as well as evaluate whether they apply to a particular user login attempt.
Libipa_hbac is case-insensitive and compatible with UTF-8.
◆ hbac_enable_debug
HBAC uses external_debug_fn for logging messages.
- Parameters
-
[in] | external_debug_fn | Pointer to external logging function. |
◆ hbac_debug_level
Debug levels for HBAC.
Enumerator |
---|
HBAC_DBG_ERROR | Fatal failure (not used).
|
HBAC_DBG_WARNING | Serious failure (out of memory, for example).
|
HBAC_DBG_INFO | Warnings (not used).
|
HBAC_DBG_TRACE | HBAC allow/disallow info.
Verbose description of rules.
|
◆ hbac_error_code
Error code returned by the evaluator.
Enumerator |
---|
HBAC_ERROR_UNKNOWN | Unexpected error.
|
HBAC_SUCCESS | Successful evaluation.
|
HBAC_ERROR_NOT_IMPLEMENTED | Function is not yet implemented.
|
HBAC_ERROR_OUT_OF_MEMORY | Ran out of memory during processing.
|
HBAC_ERROR_UNPARSEABLE_RULE | Parse error while evaluating rule.
|
◆ hbac_eval_result
Result of HBAC evaluation.
Enumerator |
---|
HBAC_EVAL_ERROR | An error occurred See the hbac_info for more details.
|
HBAC_EVAL_ALLOW | Evaluation grants access.
|
HBAC_EVAL_DENY | Evaluation denies access.
|
HBAC_EVAL_OOM | Evaluation failed due to lack of memory hbac_info is not available.
|
◆ hbac_error_string()
Display error description.
- Parameters
-
- Returns
- English string describing the error
◆ hbac_evaluate()
Evaluate an authorization request against a set of HBAC rules.
- Parameters
-
[in] | rules | A NULL-terminated list of rules to evaluate against |
[in] | hbac_req | A user authorization request |
[out] | info | Extended information (including the name of the rule that allowed access (or caused a parse error) |
- Returns
-
◆ hbac_free_info()
void hbac_free_info |
( |
struct hbac_info * |
info | ) |
|
◆ hbac_result_string()
Display result of hbac evaluation in human-readable form.
- Parameters
-
- Returns
- English string describing the evaluation result
◆ hbac_rule_is_complete()
bool hbac_rule_is_complete |
( |
struct hbac_rule * |
rule, |
|
|
uint32_t * |
missing_attrs |
|
) |
| |
Evaluate whether an HBAC rule contains all necessary elements.
- Parameters
-
- Returns
- True if the rule contains all mandatory attributes
- Note
- This function does not care if the rule is enabled or disabled