Re-implement access control using an updated model.

The new model is based on permssions, privileges and roles.
Most importantly it corrects the reverse membership that caused problems
in the previous implementation. You add permission to privileges and
privileges to roles, not the other way around (even though it works that
way behind the scenes).

A permission object is a combination of a simple group and an aci.
The linkage between the aci and the permission is the description of
the permission. This shows as the name/description of the aci.

ldap:///self and groups granting groups (v1-style) are not supported by
this model (it will be provided separately).

This makes the aci plugin internal only.

ticket 445

1 files changed, 3 insertions, 3 deletions

diff --git a/ipalib/plugins/host.py b/ipalib/plugins/host.py
index b3caf1851..a9589c6ec 100644
--- a/ipalib/plugins/host.py
+++ b/ipalib/plugins/host.py
@@ -31,10 +31,10 @@ ENROLLMENT:
 There are three enrollment scenarios when enrolling a new client:
 
 1. You are enrolling as a full administrator. The host entry may exist
-   or not. A full administrator is a member of the hostadmin rolegroup
+   or not. A full administrator is a member of the hostadmin role
    or the admins group.
 2. You are enrolling as a limited administrator. The host must already
-   exist. A limited administrator is a member of the enrollhost rolegroup.
+   exist. A limited administrator is a member of the enrollhost role.
 3. The host has been created with a one-time password.
 
 A host can only be enrolled once. If a client has enrolled and needs to
@@ -162,7 +162,7 @@ class host(LDAPObject):
     uuid_attribute = 'ipauniqueid'
     attribute_members = {
         'enrolledby': ['user'],
-        'memberof': ['hostgroup', 'netgroup', 'rolegroup'],
+        'memberof': ['hostgroup', 'netgroup', 'role'],
         'managedby': ['host'],
     }