lcas_userban.c

Go to the documentation of this file.

/*                                                                                                            
 * Copyright (c) Members of the EGEE Collaboration. 2004.
 * See http://eu-egee.org/partners/ for details on the copyright holders.
 * For license conditions see the license file or
 * http://eu-egee.org/license.html
 */

/*                                                                                                            
 * Copyright (c) 2001 EU DataGrid.                                                                             
 * For license conditions see http://www.eu-datagrid.org/license.html                                          
 *
 * Copyright (c) 2001, 2002 by 
 *     Martijn Steenbakkers <martijn@nikhef.nl>,
 *     David Groep <davidg@nikhef.nl>,
 *     NIKHEF Amsterdam, the Netherlands
 */

/******************************************************************************

lcas_userban.c

Description:
    LCAS module that makes authorization decisions based
    on a ban list
    Currently it reads a plain file that contains the
    DN's of the banned users

CVS Information:
    $Source: /cvs/jra1mw/org.glite.security.lcas-plugins-basic/src/userban/lcas_userban.c,v $
    $Date: 2005/02/28 11:45:52 $
    $Revision: 1.3 $
    $Author: msteenba $

******************************************************************************/

/*****************************************************************************
                            Include header files
******************************************************************************/
#include "lcas_config.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#if HAVE_MALLOC_H
#include <malloc.h>
#endif

#include "lcas_modules.h"
#include "lcas_gridlist.h"

/******************************************************************************
                       Define module specific variables
******************************************************************************/
static char *                 modname="lcas_userban.mod";
static char *                 userban_db = NULL;


/******************************************************************************
Function:   plugin_initialize
Description:
    Initialize plugin
Parameters:
    argc, argv
    argv[1]: database to be used by plugin
Returns:
    LCAS_MOD_SUCCESS : succes
    LCAS_MOD_FAIL    : failure
    LCAS_MOD_NOFILE  : db file not found
******************************************************************************/
#if 0
int plugin_initialize(char * plugin_db)
#endif
int plugin_initialize(int argc, char ** argv)
{
    int i;

    lcas_log_debug(2,"%s-plugin_initialize(): passed arguments:\n",modname);
    for (i=0; i < argc; i++)
    {
        lcas_log_debug(2,"%s-plugin_initialize(): arg %d is %s\n",
             modname,i,argv[i]);
    }

    if (argc > 1)
        userban_db = lcas_findfile(argv[1]);

    /* Test if userban_db can be opened */
    if (userban_db == NULL)
    {
        lcas_log(0,"\t%s-plugin_initialize() error: banned user file required !\n",
                   modname);
        return LCAS_MOD_NOFILE;
    }
    if (lcas_getfexist(1,userban_db) == NULL)
    {
        lcas_log(0,
                 "\t%s-plugin_initialize() error: Cannot find banned user file: %s\n",
                 modname,userban_db
        );
        return LCAS_MOD_NOFILE;
    }
    return LCAS_MOD_SUCCESS;
}

/******************************************************************************
Function:   plugin_confirm_authorization
Description:
    Ask for authorization by passing RSL and user credential
Parameters:
    request:   RSL request
    user_cred: user credential
Returns:
    LCAS_MOD_SUCCESS: authorization succeeded
    LCAS_MOD_FAIL   : authorization failed
    LCAS_MOD_NOFILE : db file not found
******************************************************************************/
int
plugin_confirm_authorization(lcas_request_t request, lcas_cred_id_t lcas_cred)
{
    int                           rc;
    char *                        dummy = NULL;
    char *                        user_dn = NULL;

    /*
     * check credential and get the globus name
     */
    if ( (user_dn = lcas_get_dn(lcas_cred)) == NULL)
    {
        lcas_log(0, "lcas.mod-lcas_get_fabric_authorization() error: user DN empty\n");
        goto lcas_userban_noauth;
    }

    /* Do the check */
    lcas_log_debug(0,"\t%s-plugin_confirm_authorization(): checking banned users in %s\n",
             modname,userban_db);

    rc = lcas_gridlist(user_dn, &dummy, userban_db, MATCH_ONLY_DN, NULL, NULL);

    if ( rc == LCAS_MOD_ENTRY )
    {
        /* Entry found for user_dn, so the user is banned */
        lcas_log_debug(0,"\t%s-plugin_confirm_authorization(): entry found for %s\n",
                 modname,user_dn);
        goto lcas_userban_noauth;
    }
    else if ( rc == LCAS_MOD_NOFILE )
    {
        /* file not found */
        lcas_log(0,
            "\t%s-plugin_confirm_authorization() error: Cannot find banned user file: %s\n",
            modname,userban_db);
        goto lcas_userban_nofile;
    }

 lcas_userban_auth:
    /* authorization = no entry found for user_dn */
    if (dummy != NULL) free(dummy);
    return LCAS_MOD_SUCCESS;

 lcas_userban_noauth:
    /* no authorization = entry found for user_dn */
    if (dummy != NULL) free(dummy);
    return LCAS_MOD_FAIL;

 lcas_userban_nofile:
    /* file not found */
    if (dummy != NULL) free(dummy);
    return LCAS_MOD_NOFILE;
}

/******************************************************************************
Function:   plugin_terminate
Description:
    Terminate plugin
Parameters:

Returns:
    LCAS_MOD_SUCCESS : succes
    LCAS_MOD_FAIL    : failure
******************************************************************************/
int plugin_terminate()
{
    lcas_log_debug(1,"%s-plugin_terminate(): terminating\n",modname);
    if (userban_db) { free(userban_db); userban_db=NULL; }

    return LCAS_MOD_SUCCESS;
}

---