Fixed permission reset and is_dirty.

The reset and is_dirty functionality for permission has been fixed.
New widgets have been created for select and a collection of checkboxes.
New test data files have been added for each target type.

9 files changed, 766 insertions, 1069 deletions

diff --git a/install/ui/aci.js b/install/ui/aci.js
index 959636b87..e9599d56c 100644
--- a/install/ui/aci.js
+++ b/install/ui/aci.js
@@ -2,6 +2,7 @@
 
 /*  Authors:
  *    Adam Young <ayoung@redhat.com>
+ *    Endi S. Dewata <edewata@redhat.com>
  *
  * Copyright (C) 2010 Red Hat
  * see file 'COPYING' for use and warranty information
@@ -23,49 +24,35 @@
 /* REQUIRES: ipa.js, details.js, search.js, add.js, entity.js */
 
 
-/*TODO Merge this code into  the attribtue table widget */
-IPA.populate_attribute_table = function (table, entity){
-    var attr_per_col = 400;
-    var aciattrs =  IPA.metadata[entity].aciattrs;
-    var col_span = aciattrs.length / attr_per_col + 1;
+IPA.attribute_table_widget = function(spec) {
 
-    $('tbody tr', table).remove();
+    spec = spec || {};
 
-    var tbody = $('tbody',table);
-    var td;
-    for (var a = 0; a < aciattrs.length ; a += 1){
-        var aci_tr =  $('<tr/>').appendTo(tbody);
+    var that = IPA.checkboxes_widget(spec);
 
-        td =  $('<td/>').appendTo(aci_tr);
-        td.append($('<input/>',{
-            type:"checkbox",
-            id:'aciattr-'+aciattrs[a].toLowerCase(),
-            "class":'aci-attribute'
-        }));
-        td =  $('<td/>').appendTo(aci_tr);
-        td.append($('<label/>',{
-            text:aciattrs[a].toLowerCase()}));
-    }
-};
+    that.object_type = spec.object_type;
 
-IPA.attribute_table_widget= function (spec){
     var id = spec.name;
-    var that = IPA.widget(spec);
-    var object_type = spec.objecttype || 'user';
-    var table;
     var dd_class = "other";
 
     that.create = function(container){
 
-        var dd  = $('<dd/>',{"class":dd_class}).appendTo(container);
-        table =   $('<table/>',{
+        var dd = $('<dd/>', {
+            'class': dd_class
+        }).appendTo(container);
+
+        var span = $('<span/>', {
+            name: 'attrs'
+        }).appendTo(dd);
+
+        that.table = $('<table/>', {
             id:id,
             'class':'search-table aci-attribute-table'}).
             append('<thead/>').
             append($('<tbody/>')).
-            appendTo(dd);
+            appendTo(span);
 
-        var tr = $('<tr></tr>').appendTo($('thead', table));
+        var tr = $('<tr></tr>').appendTo($('thead', that.table));
         tr.append($('<th/>',{
             style:"height:2em; vertical-align:bottom;",
             html:$('<input/>',{
@@ -76,34 +63,168 @@ IPA.attribute_table_widget= function (spec){
                 }})
         })).
             append('<th class="aci-attribute-column">Attribute</th>');
-
-        IPA.populate_attribute_table(table, object_type);
-        that.table = table;
     };
 
-    that.save = function(){
-        var values = [];
+    that.load = function(record) {
 
-        var attrs_boxes =  $('table#'+id+" td :checked");
+        that.record = record;
+        that.values = [];
 
-        for (var i = 0; i < attrs_boxes.length; i += 1) {
-            var value = attrs_boxes[i].id.substring("aciattr-".length);
-            values.push(value);
+        var values = record[that.name] || [];
+        for (var i=0; i<values.length; i++) {
+            var value = values[i].toLowerCase();
+            that.values.push(value);
         }
 
-        return values;
+        that.reset();
+    };
+
+    that.update = function() {
+        that.populate(that.object_type);
+        that.checkboxes_update();
+        that.append();
+    };
+
+    that.populate = function(object_type){
+
+        $('tbody tr', that.table).remove();
+
+        if (!object_type || object_type === '') return;
+
+        var metadata = IPA.metadata[object_type];
+        if (!metadata) return;
+
+        var aciattrs = metadata.aciattrs;
+
+        var attr_per_col = 400;
+        var col_span = aciattrs.length / attr_per_col + 1;
+
+        var tbody = $('tbody', that.table);
+        var td;
+        for (var a = 0; a < aciattrs.length ; a += 1){
+            var value = aciattrs[a].toLowerCase();
+            var aci_tr =  $('<tr/>').appendTo(tbody);
+
+            td =  $('<td/>').appendTo(aci_tr);
+            td.append($('<input/>',{
+                type: 'checkbox',
+                id: 'aciattr-'+value,
+                name: 'attrs',
+                value: value,
+                'class': 'aci-attribute'
+            }));
+            td =  $('<td/>').appendTo(aci_tr);
+            td.append($('<label/>',{
+                text:value}));
+        }
     };
 
-    that.reset =function(){
-        $('input[type=checkbox]', table).attr('checked','');
-        for (var i = 0; i < that.values.length; i+=1){
-            $('#aciattr-'+that.values[i], table).attr('checked','checked');
+    that.append = function() {
+
+        if (!that.values) return;
+
+        var unmatched = [];
+
+        for (var i=0; i<that.values.length; i++) {
+            var cb = $('#aciattr-'+that.values[i]);
+            if (!cb.length){
+                unmatched.push(that.values[i]);
+            }
+            cb.attr('checked',true);
+        }
+
+        if (unmatched.length > 0){
+            var tbody = $('tbody', that.table);
+
+            for (var j=0; j<unmatched.length; j++) {
+                var value = unmatched[j].toLowerCase();
+                var tr = $('<tr/>').appendTo(tbody);
+
+                var td = $('<td/>').appendTo(tr);
+                td.append($('<input/>', {
+                    type: 'checkbox',
+                    checked: true,
+                    id: 'aciattr-'+value,
+                    name: 'attrs',
+                    value: value,
+                    'class': 'aci-attribute'
+                }));
+
+                td = $('<td/>').appendTo(tr);
+                td.append($('<label/>', {
+                    text: value
+                }));
+            }
         }
     };
 
-    that.load = function(record){
-        that.values = record[that.name] || [];
-        that.reset();
+    return that;
+};
+
+IPA.targetgroup_widget = function(spec) {
+
+    spec = spec || {};
+
+    var that = IPA.select_widget(spec);
+
+    that.filter = spec.filter || '';
+
+    that.create = function(container) {
+        that.select = $('<select/>', {
+            name: that.name,
+            id: 'aci_target_group_select'
+        }).appendTo(container);
+    };
+
+    that.load = function(record) {
+
+        that.empty();
+
+        that.select.append($('<option/>', {
+            text: '',
+            value: ''
+        }));
+
+        var command = IPA.command({
+            method: 'group_find',
+            args: [that.filter],
+            options: {}
+        });
+
+        command.on_success = function(data, text_status, xhr) {
+
+            var groups = data.result.result;
+
+            for (var i=0; i<data.result.count; i++) {
+                var option = groups[i].cn[0];
+                that.select.append($('<option/>', {
+                    text: groups[i].cn[0],
+                    value: groups[i].cn[0]
+                }));
+            }
+
+            that.select_load(record);
+        };
+
+        command.execute();
+    };
+
+    return that;
+};
+
+IPA.type_widget = function(spec) {
+
+    spec = spec || {};
+
+    var that = IPA.select_widget(spec);
+
+    that.filter = spec.filter || '';
+
+    that.create = function(container) {
+        that.select = $('<select/>', {
+            name: that.name,
+            id: 'object_type_select'
+        }).appendTo(container);
     };
 
     return that;
@@ -311,7 +432,7 @@ IPA.hidden_widget = function(spec){
 
 
 IPA.rights_section = function () {
-    var    spec =  {
+    var spec =  {
         'name':'rights',
         'label': 'Rights'
     };
@@ -351,142 +472,149 @@ IPA.target_section = function () {
     }
 
     function display_filter_target(dl){
-        $("<dt/>").
-            append($('<input/>',{
-                type:"radio",
-                name:"type",
-                checked:"true",
-                id:"aci_by_filter"
-            })).
-            append($("<label/>",{
-                text:  "Filter" })).
-            appendTo(dl);
-
-        $('<dd/>',{
-            'class': 'aci_by_filter first'}).
-            append($('<input />',{
+        $('<dt/>').
+        append($('<input/>', {
+            type: 'radio',
+            name: 'aci_type',
+            checked: 'true',
+            id: 'aci_by_filter'
+        })).
+        append($('<label/>', {
+            text: 'Filter'
+        })).
+        appendTo(dl);
 
-                disabled:'true',
-                type:'text',
-                id:'aci_filter'
-            })).
-            appendTo(dl);
+        $('<dd/>', {
+            'class': 'aci_by_filter first'
+        }).
+        append(
+            $('<span/>', {
+                name: 'filter'
+            }).
+            append(
+                $('<input/>', {
+                    name: 'filter',
+                    disabled: 'true',
+                    type: 'text',
+                    id: 'aci_filter'
+                }))).
+        appendTo(dl);
     }
 
 
     function display_type_target(dl){
-        $("<dt/>").
-            append($('<input/>',{
-                type:"radio",
-                name:"type",
-                checked:"true",
-                id:"aci_by_type" })).
-            append($("<label/>",{
-                text:  "Object By Type " })).
-            appendTo(dl);
+        $('<dt/>').
+        append($('<input/>', {
+            type: 'radio',
+            name: 'aci_type',
+            checked: 'true',
+            id: 'aci_by_type'
+        })).
+        append($('<label/>', {
+            text: 'Object By Type'
+        })).
+        appendTo(dl);
 
-        var dd = $('<dd/>',{
-            "class":"aci_by_type first" }).
-            appendTo(dl);
+        var dd = $('<dd/>', {
+            'class': 'aci_by_type first'
+        }).appendTo(dl);
 
-        var type_select = $('<select/>', {
-            id: 'object_type_select',
-            change: function(){
-                var attribute_table = $('#aci_attributes_table');
-                IPA.populate_attribute_table(
-                    attribute_table, this.options[this.selectedIndex].value);
-            }
+        var span = $('<span/>', {
+            name: 'type'
         }).appendTo(dd);
-        var type_params=IPA.get_param_info("permission","type");
+
+        that.type_select.create(span);
+
+        var select = that.type_select.select;
+        select.change(function() {
+            that.attribute_table.object_type = this.options[this.selectedIndex].value;
+            that.attribute_table.reset();
+        });
+
+        select.append($('<option/>', {
+            value: '',
+            text: ''
+        }));
+
+        var type_params = IPA.get_param_info('permission', 'type');
         for (var pc =0; pc <  type_params.values.length; pc += 1){
-            type_select.append($('<option/>',{
-                value:  type_params.values[pc],
-                text:  type_params.values[pc]
+            select.append($('<option/>', {
+                value: type_params.values[pc],
+                text: type_params.values[pc]
             }));
         }
 
-        that.attribute_table = IPA.attribute_table_widget(
-            {name:'aci_attributes_table',object_type:'user'});
+        that.attribute_table = that.get_field('attrs');
 
         that.attribute_table.create(dl);
-
-
     }
 
     function display_query_target(dl){
         $('<dt/>').
-            append($('<input />',{
-                type:"radio",
-                name:"type",
-            id:"aci_by_query" })).
-            append($('<label />',{ html: 'By Subtree'} )).
-            appendTo(dl);
-
-        $("<dd/>",{
-            "class":'aci_by_query first'}).append($('<textarea />',{
-                id: 'aci_query_text',
-                cols:'30',
-                rows:'1'})) .appendTo(dl);
-    }
-
-    function populate_target_group_select(){
-        function find_success(result){
-            var groups = result.result.result;
-            for (var i =0; i < result.result.count; i +=1){
-                var option = groups[i].cn[0];
-                that.group_select.append($('<option/>',{
-                    text:groups[i].cn[0],
-                    value:groups[i].cn[0]
-                }));
-            }
-        }
-        function find_error(err){
-        }
-
-        $('option', that.group_select).remove();
-        IPA.command({
-            method:'group_find',
-            args:[that.group_filter.val()],
-            options:{},
-            on_success:find_success,
-            on_error:find_error}).execute();
+        append($('<input/>', {
+            type: 'radio',
+            name: 'aci_type',
+            id: 'aci_by_query'
+        })).
+        append($('<label/>', {
+            text: 'By Subtree'
+        })).
+        appendTo(dl);
+
+        $('<dd/>', {
+            'class': 'aci_by_query first'
+        }).append(
+            $('<span/>', {
+                name: 'subtree'
+            }).append(
+                $('<textarea/>', {
+                    name: 'subtree',
+                    id: 'aci_query_text',
+                    cols: '30',
+                    rows: '1'
+                }))).
+        appendTo(dl);
     }
 
     function display_group_target(dl){
         $('<dt/>' ).
-            append($('<input />',{
-                type:"radio",
-                name:"type",
-                id:"aci_by_group" })).
-            append($('<label />',{
-                html: 'Target Group'} )).
+            append($('<input />', {
+                type: 'radio',
+                name: 'aci_type',
+                id: 'aci_by_group'
+            })).
+            append($('<label/>', {
+                text: 'Target Group'
+            })).
             appendTo(dl);
 
         that.group_filter = $('<input/>',{
             type: 'text',
             id: 'group_filter' });
-        that.group_select = $('<select/>', {
-            id: 'aci_target_group_select',
-            change: function(){
-            }
-        });
 
-        $("<dd/>",{
-            'class':'aci_by_group first'
-        }).
-            append(that.group_filter).
-            append($('<label>Group Filter</label>')).
-            appendTo(dl);
+        var span = $('<span/>', {
+            name: 'targetgroup'
+        }).appendTo(dl);
 
-        $("<dd/>",{
-            'class':'aci_by_group other'
+        $('<dd/>', {
+            'class': 'aci_by_group first'
         }).
-            append(that.group_select).
-            appendTo(dl);
+        append(that.group_filter).
+        append($('<label>Group Filter</label>')).
+        appendTo(span);
+
+        var dd = $('<dd/>', {
+            'class': 'aci_by_group other'
+        }).appendTo(span);
+
+        that.group_select.create(dd);
     }
 
     that.create = function(container) {
-        var dl =  $('<dl class="aci-target"/>').appendTo(container);
+        var dl =  $('<dl/>', {
+            'class': 'aci-target'
+        }).appendTo(container);
+
         display_filter_target(dl);
         display_query_target(dl);
         display_group_target(dl);
@@ -510,88 +638,70 @@ IPA.target_section = function () {
         $('#aci_by_group', dl).click(function (){
             disable_inputs();
             enable_by(groupings[2]);
-            populate_target_group_select();
         });
 
-        $('#aci_by_query', dl).click();
-
-
+        $('#aci_by_type', dl).click();
     };
 
     that.setup = function(container) {
+        that.section_setup(container);
     };
 
-    that.load = function(result) {
-        that.result = result;
-        that.reset();
-    };
+    function set_aci_type(record) {
+        if (record.filter) {
+            $('#aci_by_filter').click();
 
-    that.reset = function() {
-        var result = that.result;
-        if(result.subtree){
-            $('#aci_query_text').val(result.subtree);
+        } else if (record.subtree) {
             $('#aci_by_query').click();
-        }else if(result.type){
-            $('#aci_by_type').click();
-            $('#object_type_select').val(result.type);
-            IPA.populate_attribute_table($('#aci_attributes_table'),
-                                         result.type);
-            if (result.attrs){
-                var unmatched = [];
-
-                for (var a = 0; a < result.attrs.length; a += 1){
-                    var cb =  $('#aciattr-'+result.attrs[a]);
-                    if (!cb.length){
-                        unmatched.push(result.attrs[a]);
-                    }
-                    cb.attr('checked',true);
-                }
-                if (unmatched.length > 0){
-                    var tbody = $('tbody',that.attribute_table.table);
-                    var td;
-                    for (var u = 0; u < unmatched.length ; u += 1){
-                        var aci_tr =  $('<tr/>').appendTo(tbody);
-                        td =  $('<td/>').appendTo(aci_tr);
-                        td.append($('<input/>',{
-                            type:"checkbox",
-                            checked: true,
-                            id:'aciattr-'+unmatched[u].toLowerCase(),
-                            "class":'aci-attribute'
-                        }));
-                        td =  $('<td/>').appendTo(aci_tr);
-                        td.append($('<label/>',{
-                            text:unmatched[u].toLowerCase()}));
-                    }
-                }
-            }
-        }else if (result.targetgroup){
-            var segments =    result.targetgroup.split(/,/);
-            var targetgroup=segments[0].split(/=/)[1];
-            that.group_filter.val( targetgroup);
+
+        } else if (record.targetgroup) {
             $('#aci_by_group').click();
-        }else if (result.filter){
-            $('#aci_by_filter').click();
-            $('#aci_filter').val(result.filter);
-        }else{
+
+        } else if (record.type) {
+            $('#aci_by_type').click();
+
+        } else {
             alert('permission with invalid target specification');
         }
+    }
+
+    that.load = function(record) {
+
+        set_aci_type(record);
+        that.group_select.filter = that.group_filter.val();
+        that.attribute_table.object_type = record.type;
+
+        that.section_load(record);
+    };
+
+    that.reset = function() {
+
+        set_aci_type(that.record);
+        that.attribute_table.object_type = that.record.type;
+
+        that.section_reset();
     };
 
     that.init = function() {
-        that.create_text({'name': 'targetgroup'});
-        that.create_textarea({'name': 'subtree'});
-        that.create_text({'name': 'type'});
-        that.create_text({'name': 'attrs'});
-        that.create_text({'name': 'filter'});
+        that.add_field(IPA.text_widget({name: 'filter'}));
+        that.add_field(IPA.textarea_widget({name: 'subtree'}));
+
+        that.group_select = IPA.targetgroup_widget({name: 'targetgroup'});
+        that.add_field(that.group_select);
+
+        that.type_select = IPA.type_widget({name: 'type'});
+        that.add_field(that.type_select);
+
+        that.attribute_table = IPA.attribute_table_widget({name: 'attrs'});
+        that.add_field(that.attribute_table);
     };
 
     that.save = function (record){
 
-        var record_type = $("input[name='type']:checked").attr('id');
+        var record_type = $("input[name='aci_type']:checked").attr('id');
 
         if (record_type === 'aci_by_group'){
-            record.targetgroup =
-                $('#aci_target_group_select option:selected').val();
+            record.targetgroup = that.group_select.save()[0];
         }else if (record_type === 'aci_by_type'){
             record.type = $('#object_type_select option:selected').val();
             record.attrs =   that.attribute_table.save().join(',');
@@ -602,11 +712,43 @@ IPA.target_section = function () {
             record.filter = filter;
         }
     };
-    that.is_dirty = function (){ return false; }
 
     return that;
 };
 
+IPA.permission_details_facet = function(spec) {
+
+    spec = spec || {};
+
+    var that = IPA.details_facet(spec);
+
+    that.refresh = function() {
+
+        var pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
+
+        var command = IPA.command({
+            'name': that.entity_name+'_show_'+pkey,
+            'method': that.entity_name+'_show',
+            'args': [pkey],
+            'options': { 'all': true, 'rights': true }
+        });
+
+        command.on_success = function(data, text_status, xhr) {
+            that.load(data.result.result);
+        };
+
+        command.on_error = function(xhr, text_status, error_thrown) {
+            var details = $('.details', that.container).empty();
+            details.append('<p>Error: '+error_thrown.name+'</p>');
+            details.append('<p>'+error_thrown.title+'</p>');
+            details.append('<p>'+error_thrown.message+'</p>');
+        };
+
+        command.execute();
+    };
+
+    return that;
+};
 
 IPA.entity_factories.permission = function () {
 
@@ -631,7 +773,7 @@ IPA.entity_factories.permission = function () {
         facet(IPA.search_facet().
               column({name:'cn'}).
               column({name:'description'})).
-        facet(IPA.details_facet({ name: 'details' }).
+        facet(IPA.permission_details_facet({ name: 'details' }).
               section(
                   IPA.stanza({
                 name:'identity',label:'Identity'  }).
@@ -758,7 +900,7 @@ IPA.entity_factories.delegation =  function() {
                                 id:'delegation_rights'})).
                         custom_input(
                             IPA.attribute_table_widget({
-                                name:'attrs', join: true})))).
+                                name:'attrs', object_type:'user', join: true})))).
         add_dialog(IPA.add_dialog({
             name: 'add',
             title: 'Add Delegation'
@@ -768,7 +910,7 @@ IPA.entity_factories.delegation =  function() {
                                                    entity:'group'})).
                    field(IPA.entity_select_widget({name:'memberof',
                                                    entity:'group', join: true})).
-                   field(IPA.attribute_table_widget({ name: 'attrs', join: true}))).
+                   field(IPA.attribute_table_widget({ name: 'attrs', object_type:'user', join: true}))).
         standard_associations();
     return that;
 
diff --git a/install/ui/details.js b/install/ui/details.js
index 2fb3889b9..a5613b5ad 100644
--- a/install/ui/details.js
+++ b/install/ui/details.js
@@ -294,6 +294,11 @@ IPA.details_section = function (spec){
         return field;
     };
 
+    that.field = function(field) {
+        that.add_field(field);
+        return that;
+    };
+
     that.create_field = function(spec) {
 
         //TODO: replace IPA.details_field with class-specific implementation
@@ -309,12 +314,24 @@ IPA.details_section = function (spec){
         return field;
     };
 
+    that.create_checkbox = function(spec) {
+        var field = IPA.checkbox_widget(spec);
+        that.add_field(field);
+        return field;
+    };
+
     that.create_radio = function(spec) {
         var field = IPA.radio_widget(spec);
         that.add_field(field);
         return field;
     };
 
+    that.create_select = function(spec) {
+        var field = IPA.select_widget(spec);
+        that.add_field(field);
+        return field;
+    };
+
     that.create_textarea = function(spec) {
         var field = IPA.textarea_widget(spec);
         that.add_field(field);
@@ -364,6 +381,8 @@ IPA.details_section = function (spec){
 
     that.load = function(record) {
 
+        that.record = record;
+
         var fields = that.fields;
 
         if (that.template) {
@@ -412,6 +431,7 @@ IPA.details_section = function (spec){
     that.section_create = that.create;
     that.section_setup = that.setup;
     that.section_load = that.load;
+    that.section_reset = that.reset;
 
     return that;
 };
@@ -759,22 +779,24 @@ IPA.details_refresh =  function () {
 
     that.pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
 
-    function on_success(data, text_status, xhr) {
+    var command = IPA.command({
+        'method': that.entity_name+'_show',
+        'args': [that.pkey],
+        'options': { 'all': true, 'rights': true }
+    });
+
+    command.on_success = function(data, text_status, xhr) {
         that.load(data.result.result);
-    }
+    };
 
-    function on_failure(xhr, text_status, error_thrown) {
+    command.on_error = function(xhr, text_status, error_thrown) {
         var details = $('.details', that.container).empty();
         details.append('<p>Error: '+error_thrown.name+'</p>');
         details.append('<p>'+error_thrown.title+'</p>');
         details.append('<p>'+error_thrown.message+'</p>');
-    }
-
-    var params = [];
-    if (that.pkey) params.push(that.pkey);
+    };
 
-    IPA.cmd( 'show', params, {all: true, rights: true}, on_success, on_failure,
-        that.entity_name );
+    command.execute();
 };
 
 IPA.details_update = function (on_win, on_fail)
diff --git a/install/ui/test/data/permission_find.json b/install/ui/test/data/permission_find.json
index cad5f0868..9308a809c 100644
--- a/install/ui/test/data/permission_find.json
+++ b/install/ui/test/data/permission_find.json
@@ -2,412 +2,58 @@
     "error": null,
     "id": 0,
     "result": {
-        "count": 47,
+        "count": 4,
         "result": [
             {
                 "cn": [
-                    "addusers"
+                    "filter"
                 ],
                 "description": [
-                    "Add Users"
+                    "Filter Permission"
                 ],
-                "dn": "cn=addusers,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "useradmin"
-                ],
-                "permissions": [
-                    "add"
-                ],
-                "type": "user"
-            },
-            {
-                "attrs": [
-                    "userPassword",
-                    "krbPrincipalKey",
-                    "sambaLMPassword",
-                    "sambaNTPassword",
-                    "passwordHistory"
-                ],
-                "cn": [
-                    "change_password"
-                ],
-                "description": [
-                    "Change a user password"
-                ],
-                "dn": "cn=change_password,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "useradmin"
+                "dn": "cn=filter,cn=permissions,cn=pbac,dc=ipa",
+                "filter": "(ou=Engineering)",
+                "objectclass": [
+                    "groupofnames",
+                    "top"
                 ],
                 "permissions": [
                     "write"
                 ]
             },
             {
-                "attrs": [
-                    "member"
-                ],
-                "cn": [
-                    "add_user_to_default_group"
-                ],
-                "description": [
-                    "Add user to default group"
-                ],
-                "dn": "cn=add_user_to_default_group,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "useradmin"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "targetgroup": "ldap:///cn=ipausers,cn=groups,cn=accounts,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "cn": [
-                    "removeusers"
-                ],
-                "description": [
-                    "Remove Users"
-                ],
-                "dn": "cn=removeusers,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "useradmin"
-                ],
-                "permissions": [
-                    "delete"
-                ],
-                "type": "user"
-            },
-            {
-                "attrs": [
-                    "givenName",
-                    "sn",
-                    "cn",
-                    "displayName",
-                    "title",
-                    "initials",
-                    "loginShell",
-                    "gecos",
-                    "homePhone",
-                    "mobile",
-                    "pager",
-                    "facsimileTelephoneNumber",
-                    "telephoneNumber",
-                    "street",
-                    "roomNumber",
-                    "l",
-                    "st",
-                    "postalCode",
-                    "manager",
-                    "secretary",
-                    "description",
-                    "carLicense",
-                    "labeledURI",
-                    "inetUserHTTPURL",
-                    "seeAlso",
-                    "employeeType",
-                    "businessCategory",
-                    "ou",
-                    "mepManagedEntry",
-                    "objectclass"
-                ],
-                "cn": [
-                    "modifyusers"
-                ],
-                "description": [
-                    "Modify Users"
-                ],
-                "dn": "cn=modifyusers,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "useradmin"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "type": "user"
-            },
-            {
-                "cn": [
-                    "addgroups"
-                ],
-                "description": [
-                    "Add Groups"
-                ],
-                "dn": "cn=addgroups,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "groupadmin"
-                ],
-                "permissions": [
-                    "add"
-                ],
-                "type": "group"
-            },
-            {
-                "cn": [
-                    "removegroups"
-                ],
-                "description": [
-                    "Remove Groups"
-                ],
-                "dn": "cn=removegroups,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "groupadmin"
-                ],
-                "permissions": [
-                    "delete"
-                ],
-                "type": "group"
-            },
-            {
-                "attrs": [
-                    "cn",
-                    "description",
-                    "gidnumber",
-                    "objectclass",
-                    "mepManagedBy",
-                    "ipaUniqueId"
-                ],
-                "cn": [
-                    "modifygroups"
-                ],
-                "description": [
-                    "Modify Groups"
-                ],
-                "dn": "cn=modifygroups,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "groupadmin"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "type": "group"
-            },
-            {
-                "attrs": [
-                    "member"
-                ],
-                "cn": [
-                    "modifygroupmembership"
-                ],
-                "description": [
-                    "Modify Group membership"
-                ],
-                "dn": "cn=modifygroupmembership,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "groupadmin"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "type": "group"
-            },
-            {
-                "cn": [
-                    "addhosts"
-                ],
-                "description": [
-                    "Add Hosts"
-                ],
-                "dn": "cn=addhosts,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "hostadmin"
-                ],
-                "permissions": [
-                    "add"
-                ],
-                "type": "host"
-            },
-            {
-                "cn": [
-                    "removehosts"
-                ],
-                "description": [
-                    "Remove Hosts"
-                ],
-                "dn": "cn=removehosts,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "hostadmin"
-                ],
-                "permissions": [
-                    "delete"
-                ],
-                "type": "host"
-            },
-            {
-                "attrs": [
-                    "description",
-                    "l",
-                    "nshostlocation",
-                    "nshardwareplatform",
-                    "nsosversion"
-                ],
-                "cn": [
-                    "modifyhosts"
-                ],
-                "description": [
-                    "Modify Hosts"
-                ],
-                "dn": "cn=modifyhosts,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "hostadmin"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "type": "host"
-            },
-            {
-                "cn": [
-                    "addhostgroups"
-                ],
-                "description": [
-                    "Add Hostgroups"
-                ],
-                "dn": "cn=addhostgroups,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "hostgroupadmin"
-                ],
-                "permissions": [
-                    "add"
-                ],
-                "type": "hostgroup"
-            },
-            {
                 "cn": [
-                    "removehostgroups"
+                    "subtree"
                 ],
                 "description": [
-                    "Remove Hostgroups"
+                    "Subtree Permission"
                 ],
-                "dn": "cn=removehostgroups,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "hostgroupadmin"
-                ],
-                "permissions": [
-                    "delete"
-                ],
-                "type": "hostgroup"
-            },
-            {
-                "attrs": [
-                    "cn",
-                    "description"
-                ],
-                "cn": [
-                    "modifyhostgroups"
-                ],
-                "description": [
-                    "Modify Hostgroups"
-                ],
-                "dn": "cn=modifyhostgroups,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "hostgroupadmin"
+                "dn": "cn=subtree,cn=permissions,cn=pbac,dc=ipa",
+                "objectclass": [
+                    "groupofnames",
+                    "top"
                 ],
                 "permissions": [
                     "write"
                 ],
-                "type": "hostgroup"
+                "subtree": "ldap:///dc=ipa"
             },
             {
-                "attrs": [
-                    "member"
-                ],
                 "cn": [
-                    "modifyhostgroupmembership"
+                    "targetgroup"
                 ],
                 "description": [
-                    "Modify Hostgroup membership"
+                    "Target Group Permission"
                 ],
-                "dn": "cn=modifyhostgroupmembership,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "hostgroupadmin"
+                "dn": "cn=targetgroup,cn=permissions,cn=pbac,dc=ipa",
+                "objectclass": [
+                    "groupofnames",
+                    "top"
                 ],
                 "permissions": [
                     "write"
                 ],
-                "type": "hostgroup"
-            },
-            {
-                "cn": [
-                    "addservices"
-                ],
-                "description": [
-                    "Add Services"
-                ],
-                "dn": "cn=addservices,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "serviceadmin"
-                ],
-                "permissions": [
-                    "add"
-                ],
-                "type": "service"
-            },
-            {
-                "cn": [
-                    "removeservices"
-                ],
-                "description": [
-                    "Remove Services"
-                ],
-                "dn": "cn=removeservices,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "serviceadmin"
-                ],
-                "permissions": [
-                    "delete"
-                ],
-                "type": "service"
-            },
-            {
-                "attrs": [
-                    "userCertificate"
-                ],
-                "cn": [
-                    "modifyservices"
-                ],
-                "description": [
-                    "Modify Services"
-                ],
-                "dn": "cn=modifyservices,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "serviceadmin"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "type": "service"
-            },
-            {
-                "cn": [
-                    "addroles"
-                ],
-                "description": [
-                    "Add Roles"
-                ],
-                "dn": "cn=addroles,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "delegationadmin"
-                ],
-                "permissions": [
-                    "add"
-                ],
-                "subtree": "ldap:///cn=*,cn=roles,cn=accounts,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "cn": [
-                    "removeroles"
-                ],
-                "description": [
-                    "Remove Roles"
-                ],
-                "dn": "cn=removeroles,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "delegationadmin"
-                ],
-                "permissions": [
-                    "delete"
-                ],
-                "subtree": "ldap:///cn=*,cn=roles,cn=accounts,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
+                "targetgroup": "ipausers"
             },
             {
                 "attrs": [
@@ -415,473 +61,23 @@
                     "description"
                 ],
                 "cn": [
-                    "modifyroles"
+                    "type"
                 ],
                 "description": [
-                    "Modify Roles"
+                    "Type Permission"
                 ],
-                "dn": "cn=modifyroles,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "delegationadmin"
+                "dn": "cn=type,cn=permissions,cn=pbac,dc=ipa",
+                "objectclass": [
+                    "groupofnames",
+                    "top"
                 ],
                 "permissions": [
                     "write"
                 ],
-                "subtree": "ldap:///cn=*,cn=roles,cn=accounts,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "attrs": [
-                    "member"
-                ],
-                "cn": [
-                    "modifyrolemembership"
-                ],
-                "description": [
-                    "Modify Role Group membership"
-                ],
-                "dn": "cn=modifyrolemembership,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "delegationadmin"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "subtree": "ldap:///cn=*,cn=roles,cn=accounts,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "attrs": [
-                    "member"
-                ],
-                "cn": [
-                    "modifyprivilegemembership"
-                ],
-                "description": [
-                    "Modify privilege membership"
-                ],
-                "dn": "cn=modifyprivilegemembership,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "delegationadmin"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "subtree": "ldap:///cn=*,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "cn": [
-                    "addautomountmaps"
-                ],
-                "description": [
-                    "Add Automount maps"
-                ],
-                "dn": "cn=addautomountmaps,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "automountadmin"
-                ],
-                "permissions": [
-                    "add"
-                ],
-                "subtree": "ldap:///automountmapname=*,cn=automount,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "cn": [
-                    "removeautomountmaps"
-                ],
-                "description": [
-                    "Remove Automount maps"
-                ],
-                "dn": "cn=removeautomountmaps,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "automountadmin"
-                ],
-                "permissions": [
-                    "delete"
-                ],
-                "subtree": "ldap:///automountmapname=*,cn=automount,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "cn": [
-                    "addautomountkeys"
-                ],
-                "description": [
-                    "Add Automount keys"
-                ],
-                "dn": "cn=addautomountkeys,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "automountadmin"
-                ],
-                "permissions": [
-                    "add"
-                ],
-                "subtree": "ldap:///automountkey=*,automountmapname=*,cn=automount,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "cn": [
-                    "removeautomountkeys"
-                ],
-                "description": [
-                    "Remove Automount keys"
-                ],
-                "dn": "cn=removeautomountkeys,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "automountadmin"
-                ],
-                "permissions": [
-                    "delete"
-                ],
-                "subtree": "ldap:///automountkey=*,automountmapname=*,cn=automount,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "cn": [
-                    "addnetgroups"
-                ],
-                "description": [
-                    "Add netgroups"
-                ],
-                "dn": "cn=addnetgroups,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "netgroupadmin"
-                ],
-                "permissions": [
-                    "add"
-                ],
-                "type": "netgroup"
-            },
-            {
-                "cn": [
-                    "removenetgroups"
-                ],
-                "description": [
-                    "Remove netgroups"
-                ],
-                "dn": "cn=removenetgroups,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "netgroupadmin"
-                ],
-                "permissions": [
-                    "delete"
-                ],
-                "type": "netgroup"
-            },
-            {
-                "attrs": [
-                    "description"
-                ],
-                "cn": [
-                    "modifynetgroups"
-                ],
-                "description": [
-                    "Modify netgroups"
-                ],
-                "dn": "cn=modifynetgroups,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "netgroupadmin"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "type": "netgroup"
-            },
-            {
-                "attrs": [
-                    "memberhost",
-                    "externalhost",
-                    "memberuser",
-                    "member"
-                ],
-                "cn": [
-                    "modifynetgroupmembership"
-                ],
-                "description": [
-                    "Modify netgroup membership"
-                ],
-                "dn": "cn=modifynetgroupmembership,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "netgroupadmin"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "type": "netgroup"
-            },
-            {
-                "attrs": [
-                    "krbPrincipalKey",
-                    "krbLastPwdChange"
-                ],
-                "cn": [
-                    "manage_host_keytab"
-                ],
-                "description": [
-                    "Manage host keytab"
-                ],
-                "dn": "cn=manage_host_keytab,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "hostadmin",
-                    "enrollhost"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "type": "host"
-            },
-            {
-                "attrs": [
-                    "krbPrincipalKey",
-                    "krbLastPwdChange"
-                ],
-                "cn": [
-                    "manage_service_keytab"
-                ],
-                "description": [
-                    "Manage service keytab"
-                ],
-                "dn": "cn=manage_service_keytab,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "serviceadmin",
-                    "admins"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "type": "service"
-            },
-            {
-                "attrs": [
-                    "enrolledBy",
-                    "objectClass"
-                ],
-                "cn": [
-                    "enroll_host"
-                ],
-                "description": [
-                    "Enroll a host"
-                ],
-                "dn": "cn=enroll_host,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "hostadmin",
-                    "enrollhost"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "type": "host"
-            },
-            {
-                "cn": [
-                    "managereplica"
-                ],
-                "description": [
-                    "Manage Replication Agreements"
-                ],
-                "dn": "cn=managereplica,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "replicaadmin"
-                ],
-                "memberindirect": [
-                    "uid=admin,cn=users,cn=accounts,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                    "cn=admins,cn=groups,cn=accounts,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-                ]
-            },
-            {
-                "cn": [
-                    "deletereplica"
-                ],
-                "description": [
-                    "Delete Replication Agreements"
-                ],
-                "dn": "cn=deletereplica,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "replicaadmin"
-                ],
-                "memberindirect": [
-                    "uid=admin,cn=users,cn=accounts,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                    "cn=admins,cn=groups,cn=accounts,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-                ]
-            },
-            {
-                "cn": [
-                    "addentitlements"
-                ],
-                "description": [
-                    "Add Entitlements"
-                ],
-                "dn": "cn=addentitlements,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "entitlementadmin"
-                ],
-                "permissions": [
-                    "add"
-                ],
-                "subtree": "ldap:///ipauniqueid=*,cn=entitlements,cn=etc,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "cn": [
-                    "removeentitlements"
-                ],
-                "description": [
-                    "Remove Entitlements"
-                ],
-                "dn": "cn=removeentitlements,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "entitlementadmin"
-                ],
-                "permissions": [
-                    "delete"
-                ],
-                "subtree": "ldap:///ipauniqueid=*,cn=entitlements,cn=etc,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "attrs": [
-                    "userCertificate"
-                ],
-                "cn": [
-                    "modifyentitlements"
-                ],
-                "description": [
-                    "Modify Entitlements"
-                ],
-                "dn": "cn=modifyentitlements,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "entitlementadmin"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "subtree": "ldap:///ipauniqueid=*,cn=entitlements,cn=etc,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "attrs": [
-                    "objectClass"
-                ],
-                "cn": [
-                    "retrieve_certs"
-                ],
-                "description": [
-                    "Retrieve Certificates from the CA"
-                ],
-                "dn": "cn=retrieve_certs,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "certadmin"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "subtree": "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "attrs": [
-                    "objectClass"
-                ],
-                "cn": [
-                    "request_certs"
-                ],
-                "description": [
-                    "Request Certificates from the CA"
-                ],
-                "dn": "cn=request_certs,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "certadmin"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "subtree": "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "attrs": [
-                    "objectClass"
-                ],
-                "cn": [
-                    "request_cert_different_host"
-                ],
-                "description": [
-                    "Request Certificates from a different host"
-                ],
-                "dn": "cn=request_cert_different_host,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "certadmin"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "subtree": "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "attrs": [
-                    "objectClass"
-                ],
-                "cn": [
-                    "certificate_status"
-                ],
-                "description": [
-                    "Get Certificates status from the CA"
-                ],
-                "dn": "cn=certificate_status,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "certadmin"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "subtree": "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "attrs": [
-                    "objectClass"
-                ],
-                "cn": [
-                    "revoke_certificate"
-                ],
-                "description": [
-                    "Revoke Certificate"
-                ],
-                "dn": "cn=revoke_certificate,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "certadmin"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "subtree": "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "attrs": [
-                    "objectClass"
-                ],
-                "cn": [
-                    "certificate_remove_hold"
-                ],
-                "description": [
-                    "Certificate Remove Hold"
-                ],
-                "dn": "cn=certificate_remove_hold,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "certadmin"
-                ],
-                "permissions": [
-                    "write"
-                ],
-                "subtree": "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-            },
-            {
-                "cn": [
-                    "update_dns"
-                ],
-                "description": [
-                    "DNS Servers Updates"
-                ],
-                "dn": "cn=update_dns,cn=permissions,cn=pbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
-                "member_privilege": [
-                    "dnsadmin",
-                    "dnsserver"
-                ],
-                "memberindirect": [
-                    "krbprincipalname=dns/ipa.ayoung.boston.devel.redhat.com@ayoung.boston.devel.redhat.com,cn=services,cn=accounts,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
-                ]
+                "type": "user"
             }
         ],
-        "summary": "47 permissions matched",
+        "summary": "4 permissions matched",
         "truncated": false
     }
 }
diff --git a/install/ui/test/data/permission_show.json b/install/ui/test/data/permission_show.json
index d823061d5..0d5784274 100644
--- a/install/ui/test/data/permission_show.json
+++ b/install/ui/test/data/permission_show.json
@@ -16,24 +16,30 @@
                 "owner": "rscwo",
                 "seealso": "rscwo"
             },
+            "attrs": [
+                "cn",
+                "description",
+                "unmatched"
+            ],
             "cn": [
-                "addusers"
+                "test"
             ],
             "description": [
-                "Add Users"
+                "Test Permission"
             ],
-            "dn": "cn=addusers,cn=permissions,cn=hbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
+            "dn": "cn=test,cn=permissions,cn=hbac,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com",
             "member": [
                 "cn=useradmin,cn=privileges,cn=accounts,dc=ayoung,dc=boston,dc=devel,dc=redhat,dc=com"
             ],
             "objectclass": [
-                "top",
-                "groupofnames"
+                "groupofnames",
+                "top"
             ],
             "permissions": [
-                "add"
+                "add",
+                "delete"
             ],
-            "type": "user"
+            "type": "group"
         },
         "summary": null,
         "value": "addusers"
diff --git a/install/ui/test/data/permission_show_filter.json b/install/ui/test/data/permission_show_filter.json
new file mode 100644
index 000000000..a7390b4dd
--- /dev/null
+++ b/install/ui/test/data/permission_show_filter.json
@@ -0,0 +1,38 @@
+{
+    "error": null,
+    "id": 0,
+    "result": {
+        "result": {
+            "attributelevelrights": {
+                "aci": "rscwo",
+                "businesscategory": "rscwo",
+                "cn": "rscwo",
+                "description": "rscwo",
+                "member": "rscwo",
+                "nsaccountlock": "rscwo",
+                "o": "rscwo",
+                "objectclass": "rscwo",
+                "ou": "rscwo",
+                "owner": "rscwo",
+                "seealso": "rscwo"
+            },
+            "cn": [
+                "filter"
+            ],
+            "description": [
+                "Filter Permission"
+            ],
+            "dn": "cn=filter,cn=permissions,cn=pbac,dc=ipa",
+            "filter": "(ou=Engineering)",
+            "objectclass": [
+                "groupofnames",
+                "top"
+            ],
+            "permissions": [
+                "write"
+            ]
+        },
+        "summary": null,
+        "value": "filter"
+    }
+}
diff --git a/install/ui/test/data/permission_show_subtree.json b/install/ui/test/data/permission_show_subtree.json
new file mode 100644
index 000000000..24255d4e9
--- /dev/null
+++ b/install/ui/test/data/permission_show_subtree.json
@@ -0,0 +1,38 @@
+{
+    "error": null,
+    "id": 0,
+    "result": {
+        "result": {
+            "attributelevelrights": {
+                "aci": "rscwo",
+                "businesscategory": "rscwo",
+                "cn": "rscwo",
+                "description": "rscwo",
+                "member": "rscwo",
+                "nsaccountlock": "rscwo",
+                "o": "rscwo",
+                "objectclass": "rscwo",
+                "ou": "rscwo",
+                "owner": "rscwo",
+                "seealso": "rscwo"
+            },
+            "cn": [
+                "subtree"
+            ],
+            "description": [
+                "Subtree Permission"
+            ],
+            "dn": "cn=subtree,cn=permissions,cn=pbac,dc=ipa",
+            "objectclass": [
+                "groupofnames",
+                "top"
+            ],
+            "permissions": [
+                "write"
+            ],
+            "subtree": "ldap:///dc=ipa"
+        },
+        "summary": null,
+        "value": "subtree"
+    }
+}
diff --git a/install/ui/test/data/permission_show_targetgroup.json b/install/ui/test/data/permission_show_targetgroup.json
new file mode 100644
index 000000000..0a140c201
--- /dev/null
+++ b/install/ui/test/data/permission_show_targetgroup.json
@@ -0,0 +1,38 @@
+{
+    "error": null,
+    "id": 0,
+    "result": {
+        "result": {
+            "attributelevelrights": {
+                "aci": "rscwo",
+                "businesscategory": "rscwo",
+                "cn": "rscwo",
+                "description": "rscwo",
+                "member": "rscwo",
+                "nsaccountlock": "rscwo",
+                "o": "rscwo",
+                "objectclass": "rscwo",
+                "ou": "rscwo",
+                "owner": "rscwo",
+                "seealso": "rscwo"
+            },
+            "cn": [
+                "targetgroup"
+            ],
+            "description": [
+                "Target Group Permission"
+            ],
+            "dn": "cn=group,cn=permissions,cn=pbac,dc=ipa",
+            "objectclass": [
+                "groupofnames",
+                "top"
+            ],
+            "permissions": [
+                "write"
+            ],
+            "targetgroup": "ipausers"
+        },
+        "summary": null,
+        "value": "group"
+    }
+}
diff --git a/install/ui/test/data/permission_show_type.json b/install/ui/test/data/permission_show_type.json
new file mode 100644
index 000000000..5407ed29c
--- /dev/null
+++ b/install/ui/test/data/permission_show_type.json
@@ -0,0 +1,43 @@
+{
+    "error": null,
+    "id": 0,
+    "result": {
+        "result": {
+            "attributelevelrights": {
+                "aci": "rscwo",
+                "businesscategory": "rscwo",
+                "cn": "rscwo",
+                "description": "rscwo",
+                "member": "rscwo",
+                "nsaccountlock": "rscwo",
+                "o": "rscwo",
+                "objectclass": "rscwo",
+                "ou": "rscwo",
+                "owner": "rscwo",
+                "seealso": "rscwo"
+            },
+            "attrs": [
+                "unmatched",
+                "cn",
+                "description"
+            ],
+            "cn": [
+                "type"
+            ],
+            "description": [
+                "Type Permission"
+            ],
+            "dn": "cn=type,cn=permissions,cn=pbac,dc=ipa",
+            "objectclass": [
+                "groupofnames",
+                "top"
+            ],
+            "permissions": [
+                "write"
+            ],
+            "type": "group"
+        },
+        "summary": null,
+        "value": "type"
+    }
+}
diff --git a/install/ui/widget.js b/install/ui/widget.js
index ee5e47107..ad42e17b8 100644
--- a/install/ui/widget.js
+++ b/install/ui/widget.js
@@ -161,6 +161,9 @@ IPA.widget = function(spec) {
             return true;
         }
 
+        values.sort();
+        that.values.sort();
+
         for (var i=0; i<values.length; i++) {
             if (values[i] != that.values[i]) {
                 return true;
@@ -267,7 +270,12 @@ IPA.text_widget = function(spec) {
 
     that.load = function(record) {
 
-        that.values = record[that.name] || [''];
+        var value = record[that.name];
+        if (value instanceof Array) {
+            that.values = value;
+        } else {
+            that.values = value ? [value] : [''];
+        }
 
         if (that.read_only) {
             var input = $('input[name="'+that.name+'"]', that.container);
@@ -306,15 +314,16 @@ IPA.text_widget = function(spec) {
 IPA.checkbox_widget = function (spec) {
 
     spec = spec || {};
-    var is_checked = spec.checked || '';
     var that = IPA.widget(spec);
 
+    that.checked = spec.checked || '';
+
     that.create = function(container) {
 
         $('<input/>', {
             type: 'checkbox',
             name: that.name,
-            checked : is_checked,
+            checked : that.checked,
             title: that.tooltip
         }).appendTo(container);
 
@@ -360,6 +369,86 @@ IPA.checkbox_widget = function (spec) {
     return that;
 };
 
+IPA.checkboxes_widget = function (spec) {
+
+    spec = spec || {};
+    var that = IPA.widget(spec);
+
+    that.options = spec.options || [];
+
+    that.create = function(container) {
+
+        for (var i=0; i<that.options.length; i++) {
+            var option = that.options[i];
+            $('<input/>', {
+                type: 'checkbox',
+                name: that.name,
+                text: option.label,
+                value: option.value,
+                title: that.tooltip
+            }).appendTo(container);
+        }
+
+        if (that.undo) {
+            $('<span/>', {
+                'name': 'undo',
+                'style': 'display: none;',
+                'html': 'undo'
+            }).appendTo(container);
+        }
+    };
+
+    that.setup = function(container) {
+
+        that.widget_setup(container);
+
+        var input = $('input[name="'+that.name+'"]', that.container);
+        input.change(function() {
+            that.show_undo();
+        });
+
+        var undo = that.get_undo();
+        undo.click(function() {
+            that.reset();
+        });
+    };
+
+    that.load = function(record) {
+        that.values = record[that.name] || [];
+        that.reset();
+    };
+
+    that.save = function() {
+        var values = [];
+
+        $('input[name="'+that.name+'"]:checked', that.container).each(function() {
+            values.push($(this).val());
+        });
+
+        return values;
+    };
+
+    that.update = function() {
+        var inputs = $('input[name="'+that.name+'"]', that.container);
+
+        for (var i=0; i<inputs.length; i++) {
+            inputs.get(i).checked = false;
+        }
+
+        for (var j=0; j<that.values.length; j++) {
+            var value = that.values[j];
+            var input = $('input[name="'+that.name+'"][value="'+value+'"]', that.container);
+            if (!input.length) continue;
+            input.get(0).checked = true;
+        }
+    };
+
+    // methods that should be invoked by subclasses
+    that.checkboxes_update = that.update;
+
+    return that;
+};
+
 IPA.radio_widget = function(spec) {
 
     spec = spec || {};
@@ -438,6 +527,86 @@ IPA.radio_widget = function(spec) {
     return that;
 };
 
+IPA.select_widget = function(spec) {
+
+    spec = spec || {};
+
+    var that = IPA.widget(spec);
+
+    that.options = spec.options || [];
+
+    that.create = function(container) {
+
+        var select = $('<select/>', {
+            name: that.name
+        }).appendTo(container);
+
+        for (var i=0; i<that.options.length; i++) {
+            var option = that.options[i];
+
+            $('<option/>', {
+                text: option.label,
+                value: option.value
+            }).appendTo(select);
+        }
+
+        if (that.undo) {
+            $('<span/>', {
+                'name': 'undo',
+                'style': 'display: none;',
+                'html': 'undo'
+            }).appendTo(container);
+        }
+    };
+
+    that.setup = function(container) {
+
+        that.widget_setup(container);
+
+        that.select = $('select[name="'+that.name+'"]', that.container);
+        that.select.change(function() {
+            that.show_undo();
+        });
+
+        var undo = that.get_undo();
+        undo.click(function() {
+            that.reset();
+        });
+    };
+
+    that.load = function(record) {
+        var value = record[that.name];
+        if (value instanceof Array) {
+            that.values = value;
+        } else {
+            that.values = value ? [value] : [''];
+        }
+        that.reset();
+    };
+
+    that.save = function() {
+        var value = that.select.val() || '';
+        return [value];
+    };
+
+    that.update = function() {
+        var value = that.values[0];
+        var option = $('option[value="'+value+'"]', that.select);
+        if (!option.length) return;
+        option.attr('selected', 'selected');
+    };
+
+    that.empty = function() {
+        $('option', that.select).remove();
+    };
+
+    // methods that should be invoked by subclasses
+    that.select_load = that.load;
+    that.select_save = that.save;
+
+    return that;
+};
+
 IPA.textarea_widget = function (spec) {
 
     spec = spec || {};
@@ -481,7 +650,12 @@ IPA.textarea_widget = function (spec) {
     };
 
     that.load = function(record) {
-        that.values = record[that.name] || [''];
+        var value = record[that.name];
+        if (value instanceof Array) {
+            that.values = value;
+        } else {
+            that.values = value ? [value] : [''];
+        }
         that.reset();
     };