gpo added (4c264ca0) · Commits · tuxist / authdb

src/admin.cpp

+43 −9

Changes for src/admin.cpp: 43 added lines, 9 removed lines.
Original line number	Diff line number	Diff line
		@@ -536,6 +536,14 @@ namespace authdb {
		return false;
		}

		/* ---- Helper: Check GPO permission ---- */
		void checkGPO(const SessionData sdat, const char gpoid) {
		if (!sdat) throw AuthBackendError("No session!");
		if (isSuperAdmin(sdat)) return;
		if (!sdat->checkGPO(uuid::uuid(gpoid)))
		throw AuthBackendError("Insufficient permissions!");
		}

		/* ---- Helper: Check domain access (non-SuperAdmins can only access their own domain) ---- */
		void checkDomainAccess(const SessionData sdat, const char cdid) {
		if (!sdat) throw AuthBackendError("No session!");
		@@ -793,19 +801,28 @@ namespace authdb {
		Group grp;
		grp.create(*domBackend, &grpdat);

		// Create admin login GPO with "Domain Admins" in allowed list
		uuid::uuid gpoid(gpo_default[0][0]);
		class GpoData gdat(gpoid);
		gdat.setName(gpo_default[0][1]);
		gdat.setDesc(gpo_default[0][2]);
		gdat.setGpoValue(strcmp(gpo_default[0][3], "true") == 0);
		std::vector<uuid::uuid> allowed;
		allowed.push_back(gid);
		gdat.setAllowed(allowed);
		// Create all default GPOs
		Gpo gpo;
		std::vector<uuid::uuid> adminAllowed;
		adminAllowed.push_back(gid);

		for (size_t i = 0; gpo_default[i][0] != nullptr; ++i) {
		uuid::uuid gpoid(gpo_default[i][0]);
		class GpoData gdat(gpoid);
		gdat.setName(gpo_default[i][1]);
		gdat.setDesc(gpo_default[i][2]);
		bool defval = (strcmp(gpo_default[i][3], "true") == 0);
		gdat.setGpoValue(defval);

		// GPOs with default=false: grant to Domain Admins
		if (!defval) {
		gdat.setAllowed(adminAllowed);
		}

		gpo.create(*domBackend, &gdat);
		}
		}
		}

		json_object_put(jreq);

		@@ -2008,18 +2025,23 @@ namespace authdb {
		try {
		if (strcmp(apiurl, "listusers") == 0) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e02");
		apiListUsers(curreq, domain);
		} else if (strcmp(apiurl, "getuser") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e02");
		apiGetUser(curreq, domain, param);
		} else if (strcmp(apiurl, "createuser") == 0) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e02");
		apiCreateUser(curreq, domain);
		} else if (strcmp(apiurl, "removeuser") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e02");
		apiRemoveUser(curreq, domain, param);
		} else if (strcmp(apiurl, "edituser") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e02");
		apiEditUser(curreq, domain, param);
		} else if (strcmp(apiurl, "listdomains") == 0) {
		apiListDomains(curreq);
		@@ -2031,18 +2053,23 @@ namespace authdb {
		apiRemoveDomain(curreq, param, sdat);
		} else if (strcmp(apiurl, "listgroups") == 0) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e03");
		apiListGroups(curreq, domain);
		} else if (strcmp(apiurl, "getgroup") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e03");
		apiGetGroup(curreq, domain, param);
		} else if (strcmp(apiurl, "creategroup") == 0) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e03");
		apiCreateGroup(curreq, domain);
		} else if (strcmp(apiurl, "removegroup") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e03");
		apiRemoveGroup(curreq, domain, param);
		} else if (strcmp(apiurl, "editgroup") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e03");
		apiEditGroup(curreq, domain, param);
		} else if (strcmp(apiurl, "listsessions") == 0) {
		checkDomainAccess(sdat, domain);
		@@ -2085,24 +2112,31 @@ namespace authdb {
		apiEditClient(curreq, domain, param);
		} else if (strcmp(apiurl, "listservices") == 0) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e04");
		apiListServices(curreq, domain);
		} else if (strcmp(apiurl, "getservice") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e04");
		apiGetService(curreq, domain, param);
		} else if (strcmp(apiurl, "createservice") == 0) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e04");
		apiCreateService(curreq, domain);
		} else if (strcmp(apiurl, "removeservice") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e04");
		apiRemoveService(curreq, domain, param);
		} else if (strcmp(apiurl, "editservice") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e04");
		apiEditService(curreq, domain, param);
		} else if (strcmp(apiurl, "export") == 0) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e05");
		apiExportDb(curreq, domain);
		} else if (strcmp(apiurl, "import") == 0) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e05");
		apiImportDb(curreq, domain);
		} else if (strcmp(apiurl, "vacuum") == 0) {
		checkDomainAccess(sdat, domain);

src/api.cpp

+8 −0

Changes for src/api.cpp: 8 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -43,6 +43,7 @@
		#include "user.h"
		#include "client.h"
		#include "gpo.h"
		#include "gpo_default.h"
		#include "group.h"
		#include "session.h"
		#include "domain.h"
		@@ -577,6 +578,13 @@ public:
		if (strcmp(key, "changeuserpw") == 0) {
		if (!_SessionData) continue;

		if (!_SessionData->checkGPO("a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e01")) {
		json_object* out = json_object_new_object();
		json_object_object_add(out, "changeuserpw", json_object_new_boolean(false));
		json_object_array_add(response, out);
		return;
		}

		std::string oldpw, newpw;
		json_object_object_foreach(val, okey, oval) {
		if (strcmp(okey, "oldpw") == 0) oldpw = json_object_get_string(oval);

src/gpo_default.h

+8 −0

Changes for src/gpo_default.h: 8 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -28,8 +28,16 @@
		#pragma once

		namespace authdb {
		// GPO array: {uuid, name, description, default_value}
		// default "false" = deny by default (allowed groups get access)
		// default "true" = allow by default (allowed groups get denied)
		inline const char *gpo_default[][4]={
		{"888cd19b-352d-11f0-a8cc-3cecefce9ac2","AuthDB: Can Login Admin Interface","Make it possible to Login into Admin Interface from AuthDB","false"},
		{"a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e01","AuthDB: Can Change Password","Allow users to change their own password via the API","true"},
		{"a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e02","AuthDB: Can Manage Users","Allow creating, editing and deleting users in admin interface","false"},
		{"a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e03","AuthDB: Can Manage Groups","Allow creating, editing and deleting groups in admin interface","false"},
		{"a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e04","AuthDB: Can Manage Services","Allow creating, editing and deleting services in admin interface","false"},
		{"a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e05","AuthDB: Can Export Import Database","Allow exporting and importing domain databases","false"},
		{nullptr}
		};
		};