Add default roles and permissions for HBAC, SUDO and pw policy

Created some default roles as examples. In doing so I realized that
we were completely missing default rules for HBAC, SUDO and password
policy so I added those as well.

I ran into a problem when the updater has a default record and an add
at the same time, it should handle it better now.

ticket 585

1 files changed, 90 insertions, 0 deletions

diff --git a/install/updates/45-roles.update b/install/updates/45-roles.update
new file mode 100644
index 000000000..7c08f667c
--- /dev/null
+++ b/install/updates/45-roles.update
@@ -0,0 +1,90 @@
+# Helpdesk roles
+dn: cn=Modify Users and Reset passwords,cn=privileges,cn=pbac,$SUFFIX
+default:objectClass: top
+default:objectClass: groupofnames
+default:objectClass: nestedgroup
+default:cn: Modify Users and Reset passwords
+default:description: Modify Users and Reset passwords
+default:member: cn=helpdesk,cn=roles,cn=accounts,$SUFFIX
+
+dn: cn=Change a user password,cn=permissions,cn=pbac,$SUFFIX
+add:member: 'cn=Modify Users and Reset passwords,cn=privileges,cn=pbac,$SUFFIX'
+
+dn: cn=Modify Users,cn=permissions,cn=pbac,$SUFFIX
+add:member: 'cn=Modify Users and Reset passwords,cn=privileges,cn=pbac,$SUFFIX'
+
+dn: cn=Modify Group membership,cn=privileges,cn=pbac,$SUFFIX
+default:objectClass: top
+default:objectClass: groupofnames
+default:objectClass: nestedgroup
+default:cn: Modify Group membership
+default:description: Modify Group membership
+default:member: cn=helpdesk,cn=roles,cn=accounts,$SUFFIX
+
+dn: cn=User Administrator,cn=roles,cn=accounts,$SUFFIX
+default:objectClass: groupofnames
+default:objectClass: nestedgroup
+default:objectClass: top
+default:cn: User Administrator
+default:description: Responsible for creating Users and Groups
+
+dn: cn=User Administrators,cn=privileges,cn=pbac,$SUFFIX
+add: member: 'cn=User Administrator,cn=roles,cn=accounts,$SUFFIX'
+
+dn: cn=Group Administrators,cn=privileges,cn=pbac,$SUFFIX
+add: member: 'cn=User Administrator,cn=roles,cn=accounts,$SUFFIX'
+
+dn: cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX
+default:objectClass: groupofnames
+default:objectClass: nestedgroup
+default:objectClass: top
+default:cn: IT Specialist
+default:description: IT Specialist
+
+dn: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
+add:member: 'cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX'
+
+dn: cn=Host Group Administrators,cn=privileges,cn=pbac,$SUFFIX
+add:member: 'cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX'
+
+dn: cn=Service Administrators,cn=privileges,cn=pbac,$SUFFIX
+add:member: 'cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX'
+
+dn: cn=Automount Administrators,cn=privileges,cn=pbac,$SUFFIX
+add:member: 'cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX'
+
+dn: cn=IT Security Specialist,cn=roles,cn=accounts,$SUFFIX
+default:objectClass: groupofnames
+default:objectClass: nestedgroup
+default:objectClass: top
+default:cn: IT Security Specialist
+default:description: IT Security Specialist
+
+dn: cn=Netgroups Administrators,cn=privileges,cn=pbac,$SUFFIX
+add:member: 'cn=IT Security Specialist,cn=roles,cn=accounts,$SUFFIX'
+
+dn: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX
+add:member: 'cn=IT Security Specialist,cn=roles,cn=accounts,$SUFFIX'
+
+dn: cn=SUDO administrator,cn=privileges,cn=pbac,$SUFFIX
+add:member: 'cn=IT Security Specialist,cn=roles,cn=accounts,$SUFFIX'
+
+dn: cn=Security Architect,cn=roles,cn=accounts,$SUFFIX
+default:objectClass: groupofnames
+default:objectClass: nestedgroup
+default:objectClass: top
+default:cn: Security Architect
+default:description: Security Architect
+
+dn: cn=Delegation Administrator,cn=privileges,cn=pbac,$SUFFIX
+add:member: 'cn=Security Architect,cn=roles,cn=accounts,$SUFFIX'
+
+dn: cn=Replication Administrators,cn=privileges,cn=pbac,$SUFFIX
+add:member: 'cn=Security Architect,cn=roles,cn=accounts,$SUFFIX'
+
+dn: cn=Write IPA Configuration,cn=privileges,cn=pbac,$SUFFIX
+add:member: 'cn=Security Architect,cn=roles,cn=accounts,$SUFFIX'
+
+dn: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX
+add:member: 'cn=Security Architect,cn=roles,cn=accounts,$SUFFIX'
+