diff options
| author | Rob Crittenden <rcritten@redhat.com> | 2011-05-16 17:39:23 -0400 |
|---|---|---|
| committer | Rob Crittenden <rcritten@redhat.com> | 2011-05-27 13:51:37 -0400 |
| commit | 9cc0754b710500519c6f5fd41a0a0237a43e04b0 (patch) | |
| tree | 73534c646557c583290f0b9e070b7d1cf0e553d7 /ipalib/plugins/user.py | |
| parent | aa29a8a769c62b07cc4e6d82fc79846505cc9fa3 (diff) | |
| download | freeipa-9cc0754b710500519c6f5fd41a0a0237a43e04b0.tar.gz freeipa-9cc0754b710500519c6f5fd41a0a0237a43e04b0.tar.xz freeipa-9cc0754b710500519c6f5fd41a0a0237a43e04b0.zip | |
Add option to limit the attributes allowed in an entry.
Kerberos ticket policy can update policy in a user entry. This allowed
set/addattr to be used to modify attributes outside of the ticket policy
perview, also bypassing all validation/normalization. Likewise the
ticket policy was updatable by the user plugin bypassing all validation.
Add two new LDAPObject values to control this behavior:
limit_object_classes: only attributes in these are allowed
disallow_object_classes: attributes in these are disallowed
By default both of these lists are empty so are skipped.
ticket 744
Diffstat (limited to 'ipalib/plugins/user.py')
| -rw-r--r-- | ipalib/plugins/user.py | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/ipalib/plugins/user.py b/ipalib/plugins/user.py index fa47cae8e..c4d875a2d 100644 --- a/ipalib/plugins/user.py +++ b/ipalib/plugins/user.py @@ -62,6 +62,7 @@ from ipalib.plugins.baseldap import * from ipalib import _, ngettext from ipalib.request import context from time import gmtime, strftime +import copy NO_UPG_MAGIC = '__no_upg__' @@ -84,6 +85,7 @@ class user(LDAPObject): object_class = ['posixaccount'] object_class_config = 'ipauserobjectclasses' possible_objectclasses = ['meporiginentry'] + disallow_object_classes = ['krbticketpolicyaux'] search_attributes_config = 'ipausersearchfields' default_attributes = [ 'uid', 'givenname', 'sn', 'homedirectory', 'loginshell', 'ou', |