summaryrefslogtreecommitdiffstats
path: root/ipaserver/install/plugins
diff options
context:
space:
mode:
authorJan Cholasta <jcholast@redhat.com>2014-06-10 14:07:35 +0200
committerPetr Viktorin <pviktori@redhat.com>2014-07-30 16:04:21 +0200
commit586373cf077f3761004414c3809785dfbcb6ef46 (patch)
tree2d08c859e827dd79079a844c5047dd29c4e8d7ab /ipaserver/install/plugins
parentfd80cc1c590a0ca977473ea71ff94e66b6c13f33 (diff)
downloadfreeipa-586373cf077f3761004414c3809785dfbcb6ef46.tar.gz
freeipa-586373cf077f3761004414c3809785dfbcb6ef46.tar.xz
freeipa-586373cf077f3761004414c3809785dfbcb6ef46.zip
Add permissions for certificate store.
Part of https://fedorahosted.org/freeipa/ticket/3259 Part of https://fedorahosted.org/freeipa/ticket/3520 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Diffstat (limited to 'ipaserver/install/plugins')
-rw-r--r--ipaserver/install/plugins/update_managed_permissions.py46
1 files changed, 46 insertions, 0 deletions
diff --git a/ipaserver/install/plugins/update_managed_permissions.py b/ipaserver/install/plugins/update_managed_permissions.py
index 608ff8913..2051bd4a2 100644
--- a/ipaserver/install/plugins/update_managed_permissions.py
+++ b/ipaserver/install/plugins/update_managed_permissions.py
@@ -163,6 +163,52 @@ NONOBJECT_PERMISSIONS = {
'authorityrevocationlist', 'crosscertificatepair',
},
},
+ 'System: Modify CA Certificate': {
+ 'ipapermlocation': DN('cn=CAcert,cn=ipa,cn=etc', api.env.basedn),
+ 'ipapermtargetfilter': {'(objectclass=pkica)'},
+ 'ipapermbindruletype': 'permission',
+ 'ipapermright': {'write'},
+ 'ipapermdefaultattr': {
+ 'cacertificate',
+ },
+ 'default_privileges': {'Certificate Administrators'},
+ },
+ 'System: Read Certificate Store Entries': {
+ 'ipapermlocation': DN('cn=certificates,cn=ipa,cn=etc', api.env.basedn),
+ 'ipapermtargetfilter': {'(objectclass=ipacertificate)'},
+ 'ipapermbindruletype': 'anonymous',
+ 'ipapermright': {'read', 'search', 'compare'},
+ 'ipapermdefaultattr': {
+ 'cn', 'objectclass', 'ipacertsubject', 'ipacertissuerserial',
+ 'ipapublickey', 'ipaconfigstring', 'cacertificate', 'ipakeytrust',
+ 'ipakeyusage', 'ipakeyextusage',
+ },
+ },
+ 'System: Add Certificate Store Entry': {
+ 'ipapermlocation': DN('cn=certificates,cn=ipa,cn=etc', api.env.basedn),
+ 'ipapermtargetfilter': {'(objectclass=ipacertificate)'},
+ 'ipapermbindruletype': 'permission',
+ 'ipapermright': {'add'},
+ 'default_privileges': {'Certificate Administrators'},
+ },
+ 'System: Modify Certificate Store Entry': {
+ 'ipapermlocation': DN('cn=certificates,cn=ipa,cn=etc', api.env.basedn),
+ 'ipapermtargetfilter': {'(objectclass=ipacertificate)'},
+ 'ipapermbindruletype': 'permission',
+ 'ipapermright': {'write'},
+ 'ipapermdefaultattr': {
+ 'ipacertissuerserial', 'ipaconfigstring', 'cacertificate',
+ 'ipakeytrust', 'ipakeyusage', 'ipakeyextusage',
+ },
+ 'default_privileges': {'Certificate Administrators'},
+ },
+ 'System: Remove Certificate Store Entry': {
+ 'ipapermlocation': DN('cn=certificates,cn=ipa,cn=etc', api.env.basedn),
+ 'ipapermtargetfilter': {'(objectclass=ipacertificate)'},
+ 'ipapermbindruletype': 'permission',
+ 'ipapermright': {'delete'},
+ 'default_privileges': {'Certificate Administrators'},
+ },
'System: Read Replication Information': {
'replaces_global_anonymous_aci': True,
'ipapermlocation': DN('cn=replication,cn=etc', api.env.basedn),