Issue Details (XML | Word | Printable)

Key: CORE-5639
Type: Bug Bug
Status: Resolved Resolved
Resolution: Fixed
Priority: Major Major
Assignee: Alexander Peshkov
Reporter: Erik Jõeveer
Votes: 0
Watchers: 4
Operations

If you were logged in you would be able to see more operations.
Firebird Core

Mapping rule using WIN_SSPI plugin: windows user group conversion to firebird role does not work

Created: 16/Oct/17 09:13 AM   Updated: 19/Oct/18 02:47 PM
Component/s: None
Affects Version/s: 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4
Fix Version/s: 4.0 Beta 1, 3.0.5

QA Status: No test


 Description  « Hide
First enable use of Windows trusted authentication:

CREATE GLOBAL MAPPING TRUSTED_AUTH
  USING PLUGIN WIN_SSPI
  FROM ANY USER
  TO USER;

Then we want to define some exact Windows trusted authentication user group mapping to firebird role:

CREATE MAPPING WIN_GLADMIN
 USING PLUGIN WIN_SSPI
 FROM Group NOOMGLADMIN
 TO ROLE GLADMIN;

But this does not work.
It seems that currently works role assignment mapping only for windows admins (Predefined_Group DOMAIN_ANY_RID_ADMINS).


Mabe this issue is retated to one 'ToDo' comment in plugin WIN_SSPI code (AuthSspi.cpp):


int WinSspiServer::authenticate(Firebird::CheckStatusWrapper* status,
IServerBlock* sBlock,
IWriter* writerInterface)
{
try
{
const bool wasActive = sspi.isActive();

sspiData.clear();
unsigned int length;
const unsigned char* bytes = sBlock->getData(&length);
sspiData.add(bytes, length);

if (!sspi.accept(sspiData))
return AUTH_CONTINUE;

if (wasActive && !sspi.isActive())
{
bool wheel = false;
string login;
sspi.getLogin(login, wheel);
ISC_systemToUtf8(login);

writerInterface->add(status, login.c_str());
if (wheel)
{
writerInterface->add(status, FB_DOMAIN_ANY_RID_ADMINS);
writerInterface->setType(status, FB_PREDEFINED_GROUP);
}

// ToDo: walk groups to which login belongs and list them using writerInterface

return AUTH_SUCCESS;
}

sBlock->putData(status, sspiData.getCount(), sspiData.begin());
}
...


 All   Comments   Change History   Subversion Commits      Sort Order: Ascending order - Click to sort in descending order
Alexander Peshkov added a comment - 19/Oct/18 02:47 PM
Groups may be used in 2 forms - HostDomainName\GroupName or just GroupName.