Convert Host default permissions to managed

Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>

2 files changed, 1 insertions, 110 deletions

diff --git a/install/share/delegation.ldif b/install/share/delegation.ldif
index 2c712bfc1..94f2e804b 100644
--- a/install/share/delegation.ldif
+++ b/install/share/delegation.ldif
@@ -167,40 +167,6 @@ objectClass: ipapermission
 cn: Modify Group membership
 member: cn=Group Administrators,cn=privileges,cn=pbac,$SUFFIX
 
-# Host administration
-
-dn: cn=Add Hosts,cn=permissions,cn=pbac,$SUFFIX
-changetype: add
-objectClass: top
-objectClass: groupofnames
-objectClass: ipapermission
-cn: Add Hosts
-member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
-
-dn: cn=Remove Hosts,cn=permissions,cn=pbac,$SUFFIX
-changetype: add
-objectClass: top
-objectClass: groupofnames
-objectClass: ipapermission
-cn: Remove Hosts
-member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
-
-dn: cn=Modify Hosts,cn=permissions,cn=pbac,$SUFFIX
-changetype: add
-objectClass: top
-objectClass: groupofnames
-objectClass: ipapermission
-cn: Modify Hosts
-member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
-
-dn: cn=Manage Host SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX
-changetype: add
-objectClass: top
-objectClass: groupofnames
-objectClass: ipapermission
-cn: Manage Host SSH Public Keys
-member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
-
 # Hostgroup administration
 
 dn: cn=Add Hostgroups,cn=permissions,cn=pbac,$SUFFIX
@@ -387,17 +353,6 @@ objectClass: ipapermission
 cn: Modify netgroup membership
 member: cn=Netgroups Administrators,cn=privileges,cn=pbac,$SUFFIX
 
-# Keytab access
-
-dn: cn=Manage host keytab,cn=permissions,cn=pbac,$SUFFIX
-changetype: add
-objectClass: top
-objectClass: groupofnames
-objectClass: ipapermission
-cn: Manage host keytab
-member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
-member: cn=Host Enrollment,cn=privileges,cn=pbac,$SUFFIX
-
 dn: cn=Manage service keytab,cn=permissions,cn=pbac,$SUFFIX
 changetype: add
 objectClass: top
@@ -411,15 +366,6 @@ member: cn=admins,cn=groups,cn=accounts,$SUFFIX
 
 # The permission and aci for this is in install/updates/dns.ldif
 
-dn: cn=Enroll a host,cn=permissions,cn=pbac,$SUFFIX
-changetype: add
-objectClass: top
-objectClass: groupofnames
-objectClass: ipapermission
-cn: Enroll a host
-member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
-member: cn=Host Enrollment,cn=privileges,cn=pbac,$SUFFIX
-
 # Replica administration
 
 dn: cn=Add Replication Agreements,cn=permissions,cn=pbac,$SUFFIX
@@ -474,16 +420,6 @@ aci: (target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "pe
 # promoted. We need mqpManagedBy and ipaUniqueId so a group can be detached.
 aci: (targetattr = "cn || description || gidnumber || objectclass || mepmanagedby || ipauniqueid")(target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Groups";allow (write) groupdn = "ldap:///cn=Modify Groups,cn=permissions,cn=pbac,$SUFFIX";)
 
-# Host administration
-
-dn: $SUFFIX
-changetype: modify
-add: aci
-aci: (target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Add Hosts";allow (add) groupdn = "ldap:///cn=Add Hosts,cn=permissions,cn=pbac,$SUFFIX";)
-aci: (target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Remove Hosts";allow (delete) groupdn = "ldap:///cn=Remove Hosts,cn=permissions,cn=pbac,$SUFFIX";)
-aci: (targetattr = "description || l || nshostlocation || nshardwareplatform || nsosversion")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Hosts";allow (write) groupdn = "ldap:///cn=Modify Hosts,cn=permissions,cn=pbac,$SUFFIX";)
-aci: (targetattr = "ipasshpubkey")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=Manage Host SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX";)
-
 # Hostgroup administration
 
 dn: $SUFFIX
@@ -536,13 +472,6 @@ aci: (target = "ldap:///ipauniqueid=*,cn=ng,cn=alt,$SUFFIX")(version 3.0;acl "pe
 aci: (targetattr = "description")(target = "ldap:///ipauniqueid=*,cn=ng,cn=alt,$SUFFIX")(version 3.0; acl "permission:Modify netgroups";allow (write) groupdn = "ldap:///cn=Modify netgroups,cn=permissions,cn=pbac,$SUFFIX";)
 aci: (targetattr = "memberhost || externalhost || memberuser || member")(target = "ldap:///ipauniqueid=*,cn=ng,cn=alt,$SUFFIX")(version 3.0;acl "permission:Modify netgroup membership";allow (write) groupdn = "ldap:///cn=Modify netgroup membership,cn=permissions,cn=pbac,$SUFFIX";)
 
-# Host keytab admin
-
-dn: $SUFFIX
-changetype: modify
-add: aci
-aci: (targetattr = "krbprincipalkey || krblastpwdchange")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage host keytab";allow (write) groupdn = "ldap:///cn=Manage host keytab,cn=permissions,cn=pbac,$SUFFIX";)
-
 # Service keytab admin
 
 dn: $SUFFIX
@@ -550,17 +479,6 @@ changetype: modify
 add: aci
 aci: (targetattr = "krbprincipalkey || krblastpwdchange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage service keytab";allow (write) groupdn = "ldap:///cn=Manage service keytab,cn=permissions,cn=pbac,$SUFFIX";)
 
-# Add the ACI needed to do host enrollment. When this occurs we
-# set the krbPrincipalName, add krbPrincipalAux to objectClass and
-# set enrolledBy to whoever ran join. enrolledBy is specifically
-# not listed here, it is set by the plugin but we don't want an
-# admin overriding it using --setattr or ldapmodify.
-
-dn: $SUFFIX
-changetype: modify
-add: aci
-aci: (targetattr = "objectclass")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Enroll a host";allow (write) groupdn = "ldap:///cn=Enroll a host,cn=permissions,cn=pbac,$SUFFIX";)
-
 # Create virtual operations entry. This is used to control access to
 # operations that don't rely on LDAP directly.
 dn: cn=virtual operations,cn=etc,$SUFFIX
diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update
index 6eef59d42..7d65e9e19 100644
--- a/install/updates/40-delegation.update
+++ b/install/updates/40-delegation.update
@@ -170,28 +170,9 @@ default:objectClass: top
 default:cn: Password Policy Administrator
 default:description: Password Policy Administrator
 
-# Allow an admin to enroll a host that has a one-time password.
-# When a host is created with a password no krbPrincipalName is set.
-# This will let it be added if the client ends up enrolling with
-# an administrator instead.
-dn: cn=Add krbPrincipalName to a host,cn=permissions,cn=pbac,$SUFFIX
-default:objectClass: top
-default:objectClass: groupofnames
-default:objectClass: ipapermission
-default:cn: Add krbPrincipalName to a host
-default:member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
-default:member: cn=Host Enrollment,cn=privileges,cn=pbac,$SUFFIX
-
-dn: $SUFFIX
-add:aci: '(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(targetfilter = "(!(krbprincipalname=*))")(targetattr = "krbprincipalname")(version 3.0;acl "permission:Add krbPrincipalName to a host"; allow (write) groupdn = "ldap:///cn=Add krbPrincipalName to a host,cn=permissions,cn=pbac,$SUFFIX";)'
-
 dn: cn=Host Enrollment,cn=privileges,cn=pbac,$SUFFIX
 add:member: 'cn=admins,cn=groups,cn=accounts,$SUFFIX'
 
-# Don't allow admins to update enrolledBy
-dn: $SUFFIX
-replace:aci:'(targetattr = "enrolledby || objectclass")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Enroll a host";allow (write) groupdn = "ldap:///cn=Enroll a host,cn=permissions,cn=pbac,$SUFFIX";)::(targetattr = "objectclass")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Enroll a host";allow (write) groupdn = "ldap:///cn=Enroll a host,cn=permissions,cn=pbac,$SUFFIX";)'
-
 # The original DNS permissions lacked the tag.
 dn: $SUFFIX
 remove:aci:'(target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "Add DNS entries";allow (add) groupdn = "ldap:///cn=add dns entries,cn=permissions,cn=pbac,$SUFFIX";)'
@@ -257,16 +238,7 @@ add:aci:'(targetattr = "automountkey || automountinformation || description")(ta
 replace:aci:'(target = "ldap:///automountkey=*,automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Add Automount keys";allow (add) groupdn = "ldap:///cn=Add Automount keys,cn=permissions,cn=pbac,$SUFFIX";)::(targetfilter = "(objectclass=automount)")(target = "ldap:///automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Add Automount keys";allow (add) groupdn = "ldap:///cn=Add Automount keys,cn=permissions,cn=pbac,$SUFFIX";)'
 replace:aci:'(target = "ldap:///automountkey=*,automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Remove Automount keys";allow (delete) groupdn = "ldap:///cn=Remove Automount keys,cn=permissions,cn=pbac,$SUFFIX";)::(targetfilter = "(objectclass=automount)")(target = "ldap:///automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Remove Automount keys";allow (delete) groupdn = "ldap:///cn=Remove Automount keys,cn=permissions,cn=pbac,$SUFFIX";)'
 
-dn: cn=Manage Host SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX
-default:objectClass: top
-default:objectClass: groupofnames
-default:objectClass: ipapermission
-default:cn: Manage Host SSH Public Keys
-default:member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
-
 dn: $SUFFIX
-add:aci:'(targetattr = "ipasshpubkey")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=Manage Host SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX";)'
-
 # Don't allow the default 'manage group membership' to be able to manage the
 # admins group
 replace:aci:'(targetattr = "member")(target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Group membership";allow (write) groupdn = "ldap:///cn=Modify Group membership,cn=permissions,cn=pbac,$SUFFIX";)::(targetfilter = "(!(cn=admins))")(targetattr = "member")(target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Group membership";allow (write) groupdn = "ldap:///cn=Modify Group membership,cn=permissions,cn=pbac,$SUFFIX";)'
@@ -283,6 +255,7 @@ add: member: 'cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX'
 dn: cn=Revoke Certificate,cn=permissions,cn=pbac,$SUFFIX
 add: member: 'cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX'
 
+
 # Automember tasks
 dn: cn=Automember Task Administrator,cn=privileges,cn=pbac,$SUFFIX
 default:objectClass: nestedgroup