diff options
| author | Petr Viktorin <pviktori@redhat.com> | 2014-06-09 17:59:53 +0200 |
|---|---|---|
| committer | Petr Viktorin <pviktori@redhat.com> | 2014-06-11 13:21:29 +0200 |
| commit | 2f3cdba54620989afba0ce1b423cddb56b841ab3 (patch) | |
| tree | 9a2375c4dbdb117f39bc3f6f0a86130b20f190d4 /ipalib/plugins/user.py | |
| parent | 6acaf73b0c6f7301d5a5d4292a4f9926cc370867 (diff) | |
| download | freeipa-2f3cdba54620989afba0ce1b423cddb56b841ab3.tar.gz freeipa-2f3cdba54620989afba0ce1b423cddb56b841ab3.tar.xz freeipa-2f3cdba54620989afba0ce1b423cddb56b841ab3.zip | |
Make 'permission' the default bind type for managed permissions
This reduces typing (or copy/pasting), and draws a bit of attention
to any non-default privileges (currently 'any' or 'anonymous').
Leaving the bindtype out by mistake isn't dangerous: by default
a permission is not granted to anyone, since it is not included in
any priviliges.
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Diffstat (limited to 'ipalib/plugins/user.py')
| -rw-r--r-- | ipalib/plugins/user.py | 9 |
1 files changed, 0 insertions, 9 deletions
diff --git a/ipalib/plugins/user.py b/ipalib/plugins/user.py index 73203405e..a1b0643a3 100644 --- a/ipalib/plugins/user.py +++ b/ipalib/plugins/user.py @@ -310,7 +310,6 @@ class user(LDAPObject): }, 'System: Read User Kerberos Login Attributes': { 'replaces_global_anonymous_aci': True, - 'ipapermbindruletype': 'permission', 'ipapermright': {'read', 'search', 'compare'}, 'ipapermdefaultattr': { 'krblastsuccessfulauth', 'krblastfailedauth', @@ -334,13 +333,11 @@ class user(LDAPObject): 'non_object': True, 'ipapermlocation': UPG_DEFINITION_DN, 'ipapermtarget': UPG_DEFINITION_DN, - 'ipapermbindruletype': 'permission', 'ipapermright': {'read', 'search', 'compare'}, 'ipapermdefaultattr': {'*'}, 'default_privileges': {'User Administrators'}, }, 'System: Add Users': { - 'ipapermbindruletype': 'permission', 'ipapermright': {'add'}, 'replaces': [ '(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Add Users";allow (add) groupdn = "ldap:///cn=Add Users,cn=permissions,cn=pbac,$SUFFIX";)', @@ -349,7 +346,6 @@ class user(LDAPObject): }, 'System: Add User to default group': { 'non_object': True, - 'ipapermbindruletype': 'permission', 'ipapermright': {'write'}, 'ipapermlocation': DN(api.env.container_group, api.env.basedn), 'ipapermtarget': DN('cn=ipausers', api.env.container_group, @@ -361,7 +357,6 @@ class user(LDAPObject): 'default_privileges': {'User Administrators'}, }, 'System: Change User password': { - 'ipapermbindruletype': 'permission', 'ipapermright': {'write'}, 'ipapermtargetfilter': [ '(objectclass=posixaccount)', @@ -383,7 +378,6 @@ class user(LDAPObject): }, }, 'System: Manage User SSH Public Keys': { - 'ipapermbindruletype': 'permission', 'ipapermright': {'write'}, 'ipapermdefaultattr': {'ipasshpubkey'}, 'replaces': [ @@ -392,7 +386,6 @@ class user(LDAPObject): 'default_privileges': {'User Administrators'}, }, 'System: Modify Users': { - 'ipapermbindruletype': 'permission', 'ipapermright': {'write'}, 'ipapermdefaultattr': { 'businesscategory', 'carlicense', 'cn', 'description', @@ -413,7 +406,6 @@ class user(LDAPObject): }, }, 'System: Remove Users': { - 'ipapermbindruletype': 'permission', 'ipapermright': {'delete'}, 'replaces': [ '(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Remove Users";allow (delete) groupdn = "ldap:///cn=Remove Users,cn=permissions,cn=pbac,$SUFFIX";)', @@ -421,7 +413,6 @@ class user(LDAPObject): 'default_privileges': {'User Administrators'}, }, 'System: Unlock User': { - 'ipapermbindruletype': 'permission', 'ipapermright': {'write'}, 'ipapermdefaultattr': { 'krblastadminunlock', 'krbloginfailedcount', 'nsaccountlock', |