summaryrefslogtreecommitdiffstats
path: root/install
diff options
context:
space:
mode:
authorRob Crittenden <rcritten@redhat.com>2009-07-10 16:40:39 -0400
committerRob Crittenden <rcritten@redhat.com>2009-07-10 16:41:05 -0400
commite31d5fb1cfc7b7b2ed47202e0ef1c462f01a046b (patch)
tree840d01d9ef8781593bc518197be6afe9c969c3a0 /install
parent51498038739cf4e3278457748938cd807095cfb3 (diff)
downloadfreeipa-e31d5fb1cfc7b7b2ed47202e0ef1c462f01a046b.tar.gz
freeipa-e31d5fb1cfc7b7b2ed47202e0ef1c462f01a046b.tar.xz
freeipa-e31d5fb1cfc7b7b2ed47202e0ef1c462f01a046b.zip
Implement support for non-LDAP-based actions that use the LDAP ACI subsystem.
There are some operations, like those for the certificate system, that don't need to write to the directory server. So instead we have an entry that we test against to determine whether the operation is allowed or not. This is done by attempting a write on the entry. If it would succeed then permission is granted. If not then denied. The write we attempt is actually invalid so the write itself will fail but the attempt will fail first if access is not permitted, so we can distinguish between the two without polluting the entry.
Diffstat (limited to 'install')
-rw-r--r--install/updates/40-delegation.update139
1 files changed, 139 insertions, 0 deletions
diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update
index 8532e5000..220c489d9 100644
--- a/install/updates/40-delegation.update
+++ b/install/updates/40-delegation.update
@@ -66,6 +66,12 @@ add:objectClass: groupofnames
add:cn: dnsserver
add:description: DNS Servers
+dn: cn=certadmin,cn=rolegroups,cn=accounts,$SUFFIX
+add:objectClass: top
+add:objectClass: groupofnames
+add:cn: certadmin
+add:description: Certificate Administrators
+
# Add the taskgroups referenced by the ACIs for user administration
dn: cn=taskgroups,cn=accounts,$SUFFIX
@@ -456,3 +462,136 @@ add:cn: manage_host_keytab
add:description: Updates DNS
add:member:'cn=dnsadmin,cn=rolegroups,cn=accounts,$SUFFIX'
add:member:'cn=dnsserver,cn=rolegroups,cn=accounts,$SUFFIX'
+
+# Create virtual operations entry. This is used to control access to
+# operations that don't rely on LDAP directly.
+dn: cn=virtual operations,$SUFFIX
+add:objectClass: top
+add:objectClass: nsContainer
+add:cn: virtual operations
+
+# Retrieve Certificate virtual op
+dn: cn=retrieve certificate,cn=virtual operations,$SUFFIX
+add:objectClass: top
+add:objectClass: nsContainer
+add:cn: retrieve certificate
+
+# Taskgroup for retrieving certs
+dn: cn=retrieve_certs,cn=taskgroups,cn=accounts,$SUFFIX
+add:objectClass: top
+add:objectClass: groupofnames
+add:cn: retrieve_certs
+add:description: Retrieve SSL Certificates
+add:member:'cn=certadmin,cn=rolegroups,cn=accounts,$SUFFIX'
+
+dn: $SUFFIX
+add: aci: '(targetattr = "objectClass")(target =
+ "ldap:///cn=retrieve certificate,cn=virtual operations,
+ $SUFFIX" )(version 3.0 ; acl "Retrieve Certificates from the
+ CA" ; allow (write) groupdn = "ldap:///cn=retrieve_certs,cn=taskgroups,
+ cn=accounts,dc=greyoak,dc=com";)'
+
+# Request Certificate virtual op
+dn: cn=request certificate,cn=virtual operations,$SUFFIX
+add:objectClass: top
+add:objectClass: nsContainer
+add:cn: request certificate
+
+# Taskgroup for requesting certs
+dn: cn=request_certs,cn=taskgroups,cn=accounts,$SUFFIX
+add:objectClass: top
+add:objectClass: groupofnames
+add:cn: reqeust_certs
+add:description: Request a SSL Certificate
+add:member:'cn=certadmin,cn=rolegroups,cn=accounts,$SUFFIX'
+
+dn: $SUFFIX
+add: aci: '(targetattr = "objectClass")(target =
+ "ldap:///cn=request certificate,cn=virtual operations,
+ $SUFFIX" )(version 3.0 ; acl "Request Certificates from the
+ CA" ; allow (write) groupdn = "ldap:///cn=request_certs,cn=taskgroups,
+ cn=accounts,dc=greyoak,dc=com";)'
+
+# Certificate Status virtual op
+dn: cn=certificate status,cn=virtual operations,$SUFFIX
+add:objectClass: top
+add:objectClass: nsContainer
+add:cn: certificate status
+
+# Taskgroup for requesting certs
+dn: cn=certificate_status,cn=taskgroups,cn=accounts,$SUFFIX
+add:objectClass: top
+add:objectClass: groupofnames
+add:cn: reqeust_certs
+add:description: Status of cert request
+add:member:'cn=certadmin,cn=rolegroups,cn=accounts,$SUFFIX'
+
+dn: $SUFFIX
+add: aci: '(targetattr = "objectClass")(target =
+ "ldap:///cn=certificate status,cn=virtual operations,
+ $SUFFIX" )(version 3.0 ; acl "Get Certificates status from the
+ CA" ; allow (write) groupdn = "ldap:///cn=certificate_status,
+ cn=taskgroups,cn=accounts,dc=greyoak,dc=com";)'
+
+# Revoke Certificate virtual op
+dn: cn=revoke certificate,cn=virtual operations,$SUFFIX
+add:objectClass: top
+add:objectClass: nsContainer
+add:cn: revoke certificate
+
+# Taskgroup for requesting certs
+dn: cn=revoke_certificate,cn=taskgroups,cn=accounts,$SUFFIX
+add:objectClass: top
+add:objectClass: groupofnames
+add:cn: reqeust_certs
+add:description: Revoke Certificate
+add:member:'cn=certadmin,cn=rolegroups,cn=accounts,$SUFFIX'
+
+dn: $SUFFIX
+add: aci: '(targetattr = "objectClass")(target =
+ "ldap:///cn=revoke certificate,cn=virtual operations,
+ $SUFFIX" )(version 3.0 ; acl "Revoke Certificate"
+ ; allow (write) groupdn = "ldap:///cn=revoke_certificate,
+ cn=taskgroups,cn=accounts,dc=greyoak,dc=com";)'
+
+# Revoke Certificate virtual op
+dn: cn=revoke certificate,cn=virtual operations,$SUFFIX
+add:objectClass: top
+add:objectClass: nsContainer
+add:cn: revoke certificate
+
+# Taskgroup for requesting certs
+dn: cn=revoke_certificate,cn=taskgroups,cn=accounts,$SUFFIX
+add:objectClass: top
+add:objectClass: groupofnames
+add:cn: reqeust_certs
+add:description: Revoke Certificate
+add:member:'cn=certadmin,cn=rolegroups,cn=accounts,$SUFFIX'
+
+dn: $SUFFIX
+add: aci: '(targetattr = "objectClass")(target =
+ "ldap:///cn=revoke certificate,cn=virtual operations,
+ $SUFFIX" )(version 3.0 ; acl "Revoke Certificate"
+ ; allow (write) groupdn = "ldap:///cn=revoke_certificate,
+ cn=taskgroups,cn=accounts,dc=greyoak,dc=com";)'
+
+# Certificate Remove Hold virtual op
+dn: cn=certificate remove hold,cn=virtual operations,$SUFFIX
+add:objectClass: top
+add:objectClass: nsContainer
+add:cn: certificate remove hold
+
+# Taskgroup for requesting certs
+dn: cn=certificate_remove_hold,cn=taskgroups,cn=accounts,$SUFFIX
+add:objectClass: top
+add:objectClass: groupofnames
+add:cn: reqeust_certs
+add:description: Certificate Remove Hold
+add:member:'cn=certadmin,cn=rolegroups,cn=accounts,$SUFFIX'
+
+dn: $SUFFIX
+add: aci: '(targetattr = "objectClass")(target =
+ "ldap:///cn=certificate remove hold,cn=virtual operations,
+ $SUFFIX" )(version 3.0 ; acl "Certificate Remove Hold"
+ ; allow (write) groupdn = "ldap:///cn=certificate_remove_hold,
+ cn=taskgroups,cn=accounts,dc=greyoak,dc=com";)'