home *** CD-ROM | disk | FTP | other *** search
/ OS/2 Collection - Online Library - January 1996 / CKITOS2196.ISO / diskette / gg244090.dsk / unc.dsk / CHAPTER.09 / SECURITY.C < prev    next >
Text File  |  1993-08-04  |  7KB  |  143 lines
  1. /***************************************************************************/
  2. /*                                                                         */
  3. /* Module:      security.c                                                 */
  4. /*                                                                         */
  5. /* Description: Implements two access checking routines for the            */
  6. /*              MessageBox example.                                        */
  7. /*              get_principal() is name based and returs the principal     */
  8. /*              name of the RPC caller                                     */
  9. /*              is_authorized() uses DCE ACL on server name space entry    */
  10. /*              for authorization checking.                                */
  11. /*                                                                         */
  12. /***************************************************************************/
  13.  
  14. # include <string.h>
  15.  
  16. # include <dce/rpc.h>
  17. # include <dce/daclif.h>
  18.  
  19. # include "common.h"
  20.  
  21. /* ACL access checking values */
  22. # define READ           0x00000001
  23. # define WRITE          0x00000002
  24. # define EXECUTE        0x00000004
  25. # define CONTROL        0x00000008
  26. # define INSERT         0x00000010
  27. # define DELETE         0x00000020
  28. # define TEST           0x00000040
  29.  
  30. /***************************************************************************/
  31. /*                                                                         */
  32. /* Name:        function get_principal()                                   */
  33. /*                                                                         */
  34. /* Description: Returns a pointer to a string with principal name          */
  35. /*              associated with clients binding handle.                    */
  36. /*              Client must set up name based authorization to send his    */
  37. /*              principal name.                                            */
  38. /*                                                                         */
  39. /***************************************************************************/
  40. char *get_principal ( handle_t bh )
  41. {
  42.         rpc_authz_handle_t      Credentials;
  43.         unsigned32              authz_svc,
  44.                                 status;
  45.         char                    *pname;
  46.  
  47.         /* get clients auth info, client should send principal name */
  48.         rpc_binding_inq_auth_client(
  49.                 bh,                     /* binding handle               */
  50.                 &Credentials,           /* returned privileges          */
  51.                 NULL,                   /* we provide no principal name */
  52.                 NULL,                   /* no protection level returned */
  53.                 NULL,                   /* no authn_svc returned        */
  54.                 &authz_svc,             /* Credential contens indicator */
  55.                 &status
  56.         );
  57.         ERRCHK( status );
  58.  
  59.         /* check the contens of credentials */
  60.         if ( authz_svc != rpc_c_authz_name )
  61.                 return NULL;
  62.  
  63.         /* cast type to string */
  64.         pname = strdup((char *)Credentials);
  65.  
  66.         /* strip off leading cell name */
  67.         return (strrchr(pname,'/') + 1);
  68. }
  69.  
  70. /***************************************************************************/
  71. /*                                                                         */
  72. /* Name:        function is_authorized()                                   */
  73. /*                                                                         */
  74. /* Description: Returns true ( != 0 ) if the principal associated with     */
  75. /*              clients binding handle has control rights granted by the   */
  76. /*              ACL on server name space entry.                            */
  77. /*              Client must set up DCE authorization to send his PAC.      */
  78. /*                                                                         */
  79. /***************************************************************************/
  80. int is_authorized ( handle_t bh )
  81. {
  82.         rpc_authz_handle_t      Credentials;
  83.         unsigned32              authz_svc,
  84.                                 status;
  85.         sec_acl_handle_t        acl;
  86.         boolean32               accessOK;
  87.         unsigned32              num_rtnd, num_avail;
  88.         uuid_t                  mgrs[10];
  89.  
  90.         /* get clients auth info, client should send PAC */
  91.         rpc_binding_inq_auth_client(
  92.                 bh,                     /* binding handle               */
  93.                 &Credentials,           /* returned privileges          */
  94.                 NULL,                   /* we provide no principal name */
  95.                 NULL,                   /* no protection level returned */
  96.                 NULL,                   /* no authn_svc returned        */
  97.                 &authz_svc,             /* Credential contens indicator */
  98.                 &status
  99.         );
  100.         ERRCHK( status )
  101.  
  102.         /* check the contens of credentials */
  103.         if ( authz_svc != rpc_c_authz_dce )
  104.                 return 0;
  105.  
  106.         /* get ACL handle */
  107.         sec_acl_bind(
  108.                 ENTRY_NAME,             /* entry name for acl checking  */
  109.                 1,                      /* get handle to entry in namespace */
  110.                 &acl,                   /* handle to acl                */
  111.                 &status
  112.         );
  113.         ERRCHK( status );
  114.  
  115.         /* get ACL manager */
  116.         sec_acl_get_manager_types(
  117.                 acl,                    /* handle to the acl            */
  118.                 sec_acl_type_object,    /* acl pts to a CDS object      */
  119.                 NUM_ELEMS( mgrs ),      /* number of items in array     */
  120.                 &num_rtnd,              /* number of items returned     */
  121.                 &num_avail,             /* number of items existing     */
  122.                 mgrs,                   /* array base                   */
  123.                 &status
  124.         );
  125.         ERRCHK( status );
  126.  
  127.         /* deny access if no ACL manager available */
  128.         if ( num_rtnd == 0 )
  129.                 return 0;
  130.  
  131.         /* proof ACL granting control right */
  132.         accessOK = sec_acl_test_access_on_behalf(
  133.                 acl,                    /* handle to acl                */
  134.                 &mgrs[0],               /* ACL mgr for object           */
  135.                 Credentials,            /* this is PAC from client      */
  136.                 CONTROL,                /* permissions to check for     */
  137.                 &status
  138.         );
  139.         ERRCHK( status );
  140.  
  141.         return accessOK;
  142. }
  143.