diff options
| author | Petr Viktorin <pviktori@redhat.com> | 2014-06-04 17:39:10 +0200 |
|---|---|---|
| committer | Petr Viktorin <pviktori@redhat.com> | 2014-06-18 14:56:43 +0200 |
| commit | 49e83256b4f3ebe05c9e9fab5a55c6d502faf491 (patch) | |
| tree | 4e75676aea9366449359d87cf6e4d1351d095162 /ipalib/plugins/pwpolicy.py | |
| parent | ca465e8ae774e88cff6916ee7640ab337890c739 (diff) | |
| download | freeipa-49e83256b4f3ebe05c9e9fab5a55c6d502faf491.tar.gz freeipa-49e83256b4f3ebe05c9e9fab5a55c6d502faf491.tar.xz freeipa-49e83256b4f3ebe05c9e9fab5a55c6d502faf491.zip | |
Convert Password Policy default permissions to managed
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Diffstat (limited to 'ipalib/plugins/pwpolicy.py')
| -rw-r--r-- | ipalib/plugins/pwpolicy.py | 26 |
1 files changed, 26 insertions, 0 deletions
diff --git a/ipalib/plugins/pwpolicy.py b/ipalib/plugins/pwpolicy.py index 5057093ba..1976675c5 100644 --- a/ipalib/plugins/pwpolicy.py +++ b/ipalib/plugins/pwpolicy.py @@ -237,6 +237,32 @@ class pwpolicy(LDAPObject): 'Password Policy Administrator', }, }, + 'System: Add Group Password Policy': { + 'ipapermright': {'add'}, + 'replaces': [ + '(target = "ldap:///cn=*,cn=$REALM,cn=kerberos,$SUFFIX")(version 3.0;acl "permission:Add Group Password Policy";allow (add) groupdn = "ldap:///cn=Add Group Password Policy,cn=permissions,cn=pbac,$SUFFIX";)', + ], + 'default_privileges': {'Password Policy Administrator'}, + }, + 'System: Delete Group Password Policy': { + 'ipapermright': {'delete'}, + 'replaces': [ + '(target = "ldap:///cn=*,cn=$REALM,cn=kerberos,$SUFFIX")(version 3.0;acl "permission:Delete Group Password Policy";allow (delete) groupdn = "ldap:///cn=Delete Group Password Policy,cn=permissions,cn=pbac,$SUFFIX";)', + ], + 'default_privileges': {'Password Policy Administrator'}, + }, + 'System: Modify Group Password Policy': { + 'ipapermright': {'write'}, + 'ipapermdefaultattr': { + 'krbmaxpwdlife', 'krbminpwdlife', 'krbpwdfailurecountinterval', + 'krbpwdhistorylength', 'krbpwdlockoutduration', + 'krbpwdmaxfailure', 'krbpwdmindiffchars', 'krbpwdminlength' + }, + 'replaces': [ + '(targetattr = "krbmaxpwdlife || krbminpwdlife || krbpwdhistorylength || krbpwdmindiffchars || krbpwdminlength || krbpwdmaxfailure || krbpwdfailurecountinterval || krbpwdlockoutduration")(target = "ldap:///cn=*,cn=$REALM,cn=kerberos,$SUFFIX")(version 3.0;acl "permission:Modify Group Password Policy";allow (write) groupdn = "ldap:///cn=Modify Group Password Policy,cn=permissions,cn=pbac,$SUFFIX";)', + ], + 'default_privileges': {'Password Policy Administrator'}, + }, } MIN_KRB5KDC_WITH_LOCKOUT = "1.8" |