<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=UTF-8" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> On 07/26/2011 06:36 AM, Alexander Bokovoy wrote: <blockquote cite="mid:4E2E9892.8030402@redhat.com" type="cite"> <pre wrap="">On 26.07.2011 06:23, Alexander Bokovoy wrote: </pre> <blockquote type="cite"> <pre wrap="">I'll send updated patch proposal today. </pre> </blockquote> <pre wrap="">Here is new patch. $ ipa hbactest --help Usage: ipa [global-options] hbactest [options] Options: -h, --help show this help message and exit --user=STR User name --srchost=STR Source host --host=STR Target host --service=STR Service --rules=LIST Rules to test. If not specified, --enabled is assumed --detail Show which rules are passed, denied, or invalid --enabled Include all enabled IPA rules into test [default] --disabled Include all disabled IPA rules into test Following modes are implemented by the plugin given (user, source host, target host, service), attempt to login user coming from source host to target host's service: 1. Use all enabled HBAC rules in IPA database to simulate: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh -------------------- Access granted: True -------------------- 2. Show detailed summary of how rules were applied: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --detail -------------------- Access granted: True -------------------- denied: my-second-rule, my-third-rule, myrule passed: allow_all 3. Test explicitly specified HBAC rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --detail --rules=my-second-rule,myrule --------------------- Access granted: False --------------------- denied: my-second-rule, myrule 4. Use all enabled HBAC rules in IPA database + explicitly specified rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --detail --rules=my-second-rule,myrule --enabled -------------------- Access granted: True -------------------- denied: my-second-rule, my-third-rule, myrule passed: allow_all 5. Test all disabled HBAC rules in IPA database: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --detail --disabled --------------------- Access granted: False --------------------- denied: new-rule 6. Test all disabled HBAC rules in IPA database + explicitly specified rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --detail --rules=my-second-rule,myrule --disabled --------------------- Access granted: False --------------------- denied: my-second-rule, myrule, new-rule 7. Test all (enabled and disabled) HBAC rules in IPA database: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --detail --enabled --disabled -------------------- Access granted: True -------------------- denied: my-second-rule, my-third-rule, myrule, new-rule passed: allow_all </pre> </blockquote> The tests imply that there are deny rules. We removed them so very soon there would be no deny rules. Should the results of the test show something like: ------------------------------ Access granted : True ------------------------------ Granted by: ------------------------------ X Y Z Or ------------------------------ Access granted : False ------------------------------ Access not granted by any allow rule ------------------------------ (I do not think you have a test for this case...) Or (for backward compatibility) ------------------------------ Access granted : False ------------------------------ Granted by: ------------------------------ X Y Z ------------------------------ Denied by: ------------------------------ A B C This format seems to be more scriptable. You do not need to deal with excaping commas if they are used in the name of the rule. But I do not insist - this is just an example of potential output. Rob, Martin do you have any comments, suggestions? <blockquote cite="mid:4E2E9892.8030402@redhat.com" type="cite"> <pre wrap=""></pre> <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> _______________________________________________ Freeipa-devel mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-devel@redhat.com">Freeipa-devel@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-devel">https://www.redhat.com/mailman/listinfo/freeipa-devel</a></pre> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> </body> </html>