librpc: Add context as to if this token should be used for claims evaluation

Claims evaluation is added to the core se_access_check() library, but
not all callers provide claims in the security_token and we want to
be able to disable this new and complex code if needed.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

diff --git a/librpc/idl/security.idl b/librpc/idl/security.idl
index b19a8cbcf58456faeb43dd10ecfc72b74317a4ac..903b00c0c92c69da3a678f85c47d1f63c28e05d3 100644 (file)
--- a/librpc/idl/security.idl
+++ b/librpc/idl/security.idl
@@ -756,7 +756,21 @@ interface security
                SE_GROUP_ENABLED_BY_DEFAULT |
                SE_GROUP_ENABLED;
 
-       /* This is not yet sent over the network, but is simply defined in IDL */
+       /*
+        * Should cliams be evaluated on this token?
+        *
+        * 0 is invalid to catch a zeroed token
+        */
+       typedef enum {
+               CLAIMS_EVALUATION_INVALID_STATE=0,
+               CLAIMS_EVALUATION_NEVER = 1,
+               CLAIMS_EVALUATION_ALWAYS = 2
+       } claims_evaluation_control;
+
+       /*
+        * This is linearised to pass authentication over the NP proxy
+        * from smbd to RPC servers, but is not in public network protocols
+        */
        typedef [public] struct {
                uint32 num_sids;
                [size_is(num_sids)] dom_sid sids[*];
@@ -770,6 +784,14 @@ interface security
                [size_is(num_user_claims)] CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 user_claims[*];
                [size_is(num_device_claims)] CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 device_claims[*];
                [size_is(num_device_sids)] dom_sid device_sids[*];
+
+               /*
+                * This allows us to disable claims evaluation on a
+                * per-token basis, allowing library code to remain
+                * distinct from configuration by passing this in as a
+                * flag here
+                */
+               claims_evaluation_control evaluate_claims;
        } security_token;
 
         typedef [public] struct {