Drop ACCESS_AUTH_EXPIRED_* extended auth states

Alternative approaches being discussed by squid-dev still, but agreed
that this was the wrong approach to implementation rollout.

diff --git a/src/acl/Acl.h b/src/acl/Acl.h
index 66b142457015bdd8d86d64b88165f6e6bf255d5a..6eff7c1b688ee329d2bb76692ff1a06771f60a1c 100644 (file)
--- a/src/acl/Acl.h
+++ b/src/acl/Acl.h
@@ -116,8 +116,6 @@ typedef enum {
 
     // Authentication ACL result states
     ACCESS_AUTH_REQUIRED,    // Missing Credentials
-    ACCESS_AUTH_EXPIRED_OK,  // Expired now. Were Okay.
-    ACCESS_AUTH_EXPIRED_BAD  // Expired now. Were Failed.
 } allow_t;
 
 inline std::ostream &
@@ -136,12 +134,6 @@ operator <<(std::ostream &o, const allow_t a)
     case ACCESS_AUTH_REQUIRED:
         o << "AUTH_REQUIRED";
         break;
-    case ACCESS_AUTH_EXPIRED_OK:
-        o << "AUTH_EXPIRED_OK";
-        break;
-    case ACCESS_AUTH_EXPIRED_BAD:
-        o << "AUTH_EXPIRED_BAD";
-        break;
     }
     return o;
 }

diff --git a/src/auth/AclMaxUserIp.cc b/src/auth/AclMaxUserIp.cc
index 1aa9155357268213dee3cfdebac46da9b2122918..8c07bf7723df26bb155d24475289dc3b3d0dcef5 100644 (file)
--- a/src/auth/AclMaxUserIp.cc
+++ b/src/auth/AclMaxUserIp.cc
@@ -157,14 +157,12 @@ ACLMaxUserIP::match(ACLChecklist *cl)
     // convert to tri-state ACL match 1,0,-1
     switch (answer) {
     case ACCESS_ALLOWED:
-    case ACCESS_AUTH_EXPIRED_OK:
         // check for a match
         ti = match(checklist->auth_user_request, checklist->src_addr);
         checklist->auth_user_request = NULL;
         return ti;
 
     case ACCESS_DENIED:
-    case ACCESS_AUTH_EXPIRED_BAD:
         return 0; // non-match
 
     case ACCESS_DUNNO:

diff --git a/src/auth/AclProxyAuth.cc b/src/auth/AclProxyAuth.cc
index 085e6c4e9c01d3a14bdf4bbce13f2ec1df07a48f..f1c2ad5682f6da80d5864d4a174facf69f84bd99 100644 (file)
--- a/src/auth/AclProxyAuth.cc
+++ b/src/auth/AclProxyAuth.cc
@@ -85,12 +85,10 @@ ACLProxyAuth::match(ACLChecklist *checklist)
     // convert to tri-state ACL match 1,0,-1
     switch (answer) {
     case ACCESS_ALLOWED:
-    case ACCESS_AUTH_EXPIRED_OK:
         // check for a match
         return matchProxyAuth(checklist);
 
     case ACCESS_DENIED:
-    case ACCESS_AUTH_EXPIRED_BAD:
         return 0; // non-match
 
     case ACCESS_DUNNO:

diff --git a/src/client_side_request.cc b/src/client_side_request.cc
index 422a4124986c7fa685e75e2abfc41eabd9c306fc..4fcca310768055f7a376cec07a21d1fc7f6ef4be 100644 (file)
--- a/src/client_side_request.cc
+++ b/src/client_side_request.cc
@@ -760,12 +760,12 @@ ClientRequestContext::clientAccessCheckDone(const allow_t &answer)
         proxy_auth_msg = http->request->auth_user_request->denyMessage("<null>");
 #endif
 
-    if (answer != ACCESS_ALLOWED && answer != ACCESS_AUTH_EXPIRED_OK) {
+    if (answer != ACCESS_ALLOWED) {
         // auth has a grace period where credentials can be expired but okay not to challenge.
 
         /* Send an auth challenge or error */
         // XXX: do we still need aclIsProxyAuth() ?
-        bool auth_challenge = (answer == ACCESS_AUTH_REQUIRED || answer == ACCESS_AUTH_EXPIRED_BAD || aclIsProxyAuth(AclMatchedName));
+        bool auth_challenge = (answer == ACCESS_AUTH_REQUIRED || aclIsProxyAuth(AclMatchedName));
         debugs(85, 5, "Access Denied: " << http->uri);
         debugs(85, 5, "AclMatchedName = " << (AclMatchedName ? AclMatchedName : "<null>"));
 #if USE_AUTH
@@ -830,7 +830,7 @@ ClientRequestContext::clientAccessCheckDone(const allow_t &answer)
         return;
     }
 
-    /* ACCESS_ALLOWED (or auth in grace period ACCESS_AUTH_EXPIRED_OK) continues here ... */
+    /* ACCESS_ALLOWED continues here ... */
     safe_free(http->uri);
 
     http->uri = xstrdup(urlCanonical(http->request));

diff --git a/src/external_acl.cc b/src/external_acl.cc
index a358895fb9bca01944f531f96074442de8859e12..618b97a804bdab25dc3cb73300e63cd909ce72a5 100644 (file)
--- a/src/external_acl.cc
+++ b/src/external_acl.cc
@@ -866,11 +866,9 @@ ACLExternal::match(ACLChecklist *checklist)
     // convert to tri-state ACL match 1,0,-1
     switch (answer) {
     case ACCESS_ALLOWED:
-    case ACCESS_AUTH_EXPIRED_OK:
         return 1; // match
 
     case ACCESS_DENIED:
-    case ACCESS_AUTH_EXPIRED_BAD:
         return 0; // non-match
 
     case ACCESS_DUNNO:

diff --git a/src/peer_select.cc b/src/peer_select.cc
index eae94e1c3bc37f54deb805bd15dbc469de8383db..e33d9fde1bfe0af1e27d16c0de7a67bd90b02ca8 100644 (file)
--- a/src/peer_select.cc
+++ b/src/peer_select.cc
@@ -188,8 +188,6 @@ peerCheckNeverDirectDone(allow_t answer, void *data)
     case ACCESS_DUNNO:  // not relevant.
         break;
     case ACCESS_AUTH_REQUIRED:
-    case ACCESS_AUTH_EXPIRED_OK:
-    case ACCESS_AUTH_EXPIRED_BAD:
         debugs(44, DBG_IMPORTANT, "WARNING: never_direct resulted in " << answer << ". Username ACLs are not reliable here.");
         break;
     }
@@ -213,8 +211,6 @@ peerCheckAlwaysDirectDone(allow_t answer, void *data)
     case ACCESS_DUNNO:  // not relevant.
         break;
     case ACCESS_AUTH_REQUIRED:
-    case ACCESS_AUTH_EXPIRED_OK:
-    case ACCESS_AUTH_EXPIRED_BAD:
         debugs(44, DBG_IMPORTANT, "WARNING: always_direct resulted in " << answer << ". Username ACLs are not reliable here.");
         break;
     }