diff options
| author | Nathaniel McCallum <npmccallum@redhat.com> | 2014-02-06 11:27:29 -0500 |
|---|---|---|
| committer | Petr Viktorin <pviktori@redhat.com> | 2014-02-13 19:43:29 +0100 |
| commit | a91c0972b992dbd15e78f2ba6982768ac958e4bd (patch) | |
| tree | bdbfa82df947622753fd38c3cf1e0e6bcc363066 | |
| parent | a2ae2918dd3dce00c4d5b7aa61d6f5ba08b5e97f (diff) | |
| download | freeipa-a91c0972b992dbd15e78f2ba6982768ac958e4bd.tar.gz freeipa-a91c0972b992dbd15e78f2ba6982768ac958e4bd.tar.xz freeipa-a91c0972b992dbd15e78f2ba6982768ac958e4bd.zip | |
Update ACIs to permit users to add/delete their own tokens
https://fedorahosted.org/freeipa/ticket/4087
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
| -rw-r--r-- | freeipa.spec.in | 6 | ||||
| -rw-r--r-- | install/share/default-aci.ldif | 1 | ||||
| -rw-r--r-- | install/updates/40-otp.update | 1 |
3 files changed, 5 insertions, 3 deletions
diff --git a/freeipa.spec.in b/freeipa.spec.in index a908adfc2..bbceca376 100644 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -21,7 +21,7 @@ Source0: freeipa-%{version}.tar.gz BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) %if ! %{ONLY_CLIENT} -BuildRequires: 389-ds-base-devel >= 1.3.2.10 +BuildRequires: 389-ds-base-devel >= 1.3.2.11 BuildRequires: svrcore-devel BuildRequires: policycoreutils >= %{POLICYCOREUTILSVER} BuildRequires: systemd-units @@ -97,7 +97,7 @@ Group: System Environment/Base Requires: %{name}-python = %{version}-%{release} Requires: %{name}-client = %{version}-%{release} Requires: %{name}-admintools = %{version}-%{release} -Requires: 389-ds-base >= 1.3.2.10 +Requires: 389-ds-base >= 1.3.2.11 Requires: openldap-clients > 2.4.35-4 %if 0%{?fedora} == 18 Requires: nss >= 3.14.3-2 @@ -153,7 +153,7 @@ Requires: zip Requires: policycoreutils >= %{POLICYCOREUTILSVER} Requires: tar Requires(pre): certmonger >= 0.65 -Requires(pre): 389-ds-base >= 1.3.2.10 +Requires(pre): 389-ds-base >= 1.3.2.11 Requires: fontawesome-fonts Requires: open-sans-fonts diff --git a/install/share/default-aci.ldif b/install/share/default-aci.ldif index 9af9ab28c..b7df72109 100644 --- a/install/share/default-aci.ldif +++ b/install/share/default-aci.ldif @@ -103,3 +103,4 @@ add: aci aci: (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || ipatokenUniqueID || description || ipatokenOwner || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Users can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN";) aci: (targetfilter = "(objectClass=ipaToken)")(targetattrs = "ipatokenUniqueID || description || ipatokenOwner || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Users can write basic token info"; allow (write) userattr = "ipatokenOwner#USERDN";) aci: (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPkey || ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPclockOffset || ipatokenTOTPtimeStep")(version 3.0; acl "Users can add TOTP token secrets"; allow (write, search) userattr = "ipatokenOwner#USERDN";) +aci: (target = "ldap:///ipatokenuniqueid=*,cn=otp,$SUFFIX")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create and delete tokens"; allow (add, delete) userattr = "ipatokenOwner#SELFDN";) diff --git a/install/updates/40-otp.update b/install/updates/40-otp.update index 83dfab7c0..8e1300fb3 100644 --- a/install/updates/40-otp.update +++ b/install/updates/40-otp.update @@ -7,6 +7,7 @@ dn: $SUFFIX add: aci:'(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || ipatokenUniqueID || description || ipatokenOwner || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Users can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN";)' add: aci:'(targetfilter = "(objectClass=ipaToken)")(targetattrs = "ipatokenUniqueID || description || ipatokenOwner || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Users can write basic token info"; allow (write) userattr = "ipatokenOwner#USERDN";)' add: aci:'(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPkey || ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPclockOffset || ipatokenTOTPtimeStep")(version 3.0; acl "Users can add TOTP token secrets"; allow (write, search) userattr = "ipatokenOwner#USERDN";)' +add: aci:'(target = "ldap:///ipatokenuniqueid=*,cn=otp,$SUFFIX")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create and delete tokens"; allow (add, delete) userattr = "ipatokenOwner#SELFDN";)' dn: cn=radiusproxy,$SUFFIX default: objectClass: nsContainer |