summaryrefslogtreecommitdiffstats
path: root/ipalib/plugins/group.py
diff options
context:
space:
mode:
authorRob Crittenden <rcritten@redhat.com>2010-12-01 11:23:52 -0500
committerSimo Sorce <ssorce@redhat.com>2010-12-01 20:42:31 -0500
commit4ad8055341b9f12c833abdf757755ed95f1b375e (patch)
tree1733fffdfe47574f2c5eb723e52f88cd58a7e0a4 /ipalib/plugins/group.py
parent85d5bfd1b19b0ed6282a8c6cc056e8e550dde79d (diff)
downloadfreeipa-4ad8055341b9f12c833abdf757755ed95f1b375e.tar.gz
freeipa-4ad8055341b9f12c833abdf757755ed95f1b375e.tar.xz
freeipa-4ad8055341b9f12c833abdf757755ed95f1b375e.zip
Re-implement access control using an updated model.
The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
Diffstat (limited to 'ipalib/plugins/group.py')
-rw-r--r--ipalib/plugins/group.py4
1 files changed, 2 insertions, 2 deletions
diff --git a/ipalib/plugins/group.py b/ipalib/plugins/group.py
index f26792a56..290d7ba1d 100644
--- a/ipalib/plugins/group.py
+++ b/ipalib/plugins/group.py
@@ -89,8 +89,8 @@ class group(LDAPObject):
uuid_attribute = 'ipauniqueid'
attribute_members = {
'member': ['user', 'group'],
- 'memberof': ['group', 'netgroup', 'rolegroup', 'taskgroup'],
- 'memberindirect': ['user', 'group', 'netgroup', 'rolegroup', 'taskgroup'],
+ 'memberof': ['group', 'netgroup', 'role',],
+ 'memberindirect': ['user', 'group', 'netgroup', 'role'],
}
rdnattr = 'cn'