diff options
| author | Petr Viktorin <pviktori@redhat.com> | 2014-06-04 15:35:31 +0200 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2014-06-10 13:55:56 +0200 |
| commit | 46faed0b4bb2169fd2be79809b9a65b77a72ee14 (patch) | |
| tree | a0674579a8ef300269a42c6c7eedb90fb3074e79 /ipalib | |
| parent | 53a63ae3461ed3d61bf8355da244ecc2e41b0e9d (diff) | |
| download | freeipa-46faed0b4bb2169fd2be79809b9a65b77a72ee14.tar.gz freeipa-46faed0b4bb2169fd2be79809b9a65b77a72ee14.tar.xz freeipa-46faed0b4bb2169fd2be79809b9a65b77a72ee14.zip | |
Add missing attributes to User managed permissions
- Add nsAccountLock to the Unlock user accounts permission
- Add member to Read User Membership
- Add userClass and preferredLanguage to Modify Users
https://fedorahosted.org/freeipa/ticket/3697
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Diffstat (limited to 'ipalib')
| -rw-r--r-- | ipalib/plugins/user.py | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/ipalib/plugins/user.py b/ipalib/plugins/user.py index 071cda5aa..4eb35bd84 100644 --- a/ipalib/plugins/user.py +++ b/ipalib/plugins/user.py @@ -398,7 +398,8 @@ class user(LDAPObject): 'initials', 'l', 'labeleduri', 'loginshell', 'manager', 'mepmanagedentry', 'mobile', 'objectclass', 'ou', 'pager', 'postalcode', 'roomnumber', 'secretary', 'seealso', 'sn', 'st', - 'street', 'telephonenumber', 'title' + 'street', 'telephonenumber', 'title', 'userclass', + 'preferredlanguage', }, 'replaces': [ '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou || mepmanagedentry || objectclass")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Users";allow (write) groupdn = "ldap:///cn=Modify Users,cn=permissions,cn=pbac,$SUFFIX";)', @@ -420,7 +421,7 @@ class user(LDAPObject): 'ipapermbindruletype': 'permission', 'ipapermright': {'write'}, 'ipapermdefaultattr': { - 'krblastadminunlock', 'krbloginfailedcount' + 'krblastadminunlock', 'krbloginfailedcount', 'nsaccountlock', }, 'replaces': [ '(targetattr = "krbLastAdminUnlock || krbLoginFailedCount")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Unlock user accounts";allow (write) groupdn = "ldap:///cn=Unlock user accounts,cn=permissions,cn=pbac,$SUFFIX";)', |