If user cannot be mapped to uid, continue as anonymous #45
Conversation
This allows anonymous users to access data via the root protocol.
|
Hm - I'm uncomfortable with this one. It allows mistakes access all of a sudden, right? |
|
Marking as draft to work through an idea that Brian suggested: only treat a client as anonymous if the username lookup failed and there was no mapping done. (gmapopt:trymap resulting in a DN hash, rather than a username.) |
… as anonymous For names generated from DN or DN hash, treat the client as anonymous if the username cannot be found. If the name came from a grid-mapfile, fail if the username cannot be found.
|
Since it does allocate a string and do a hash map lookup, can you only do the gridmap mapping check in the failure case where you use it? Maybe peel it off as a separate static method? |
|
That's a good idea, thanks. I'd been thinking about turning it around: only try |
|
That'd be even better! Note that you would then need to check that this is a |
…DN hash), continue as anonymous
|
Is this tested? If so, seems simple enough. |
|
If this tests out fine, I’m happy with the implementation approach. |
|
I've applied it to the production Nebraska SEs, and no issues to report. I think it's ready to consider squashing and merging. |
3 participants
This allows unmapped GSI clients to access data via the root protocol as an anonymous user.