diff options
author | Jan Cholasta <jcholast@redhat.com> | 2014-06-10 14:07:35 +0200 |
---|---|---|
committer | Petr Viktorin <pviktori@redhat.com> | 2014-07-30 16:04:21 +0200 |
commit | 586373cf077f3761004414c3809785dfbcb6ef46 (patch) | |
tree | 2d08c859e827dd79079a844c5047dd29c4e8d7ab /ipaserver/install/plugins | |
parent | fd80cc1c590a0ca977473ea71ff94e66b6c13f33 (diff) | |
download | freeipa-586373cf077f3761004414c3809785dfbcb6ef46.tar.gz freeipa-586373cf077f3761004414c3809785dfbcb6ef46.tar.xz freeipa-586373cf077f3761004414c3809785dfbcb6ef46.zip |
Add permissions for certificate store.
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Diffstat (limited to 'ipaserver/install/plugins')
-rw-r--r-- | ipaserver/install/plugins/update_managed_permissions.py | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/ipaserver/install/plugins/update_managed_permissions.py b/ipaserver/install/plugins/update_managed_permissions.py index 608ff8913..2051bd4a2 100644 --- a/ipaserver/install/plugins/update_managed_permissions.py +++ b/ipaserver/install/plugins/update_managed_permissions.py @@ -163,6 +163,52 @@ NONOBJECT_PERMISSIONS = { 'authorityrevocationlist', 'crosscertificatepair', }, }, + 'System: Modify CA Certificate': { + 'ipapermlocation': DN('cn=CAcert,cn=ipa,cn=etc', api.env.basedn), + 'ipapermtargetfilter': {'(objectclass=pkica)'}, + 'ipapermbindruletype': 'permission', + 'ipapermright': {'write'}, + 'ipapermdefaultattr': { + 'cacertificate', + }, + 'default_privileges': {'Certificate Administrators'}, + }, + 'System: Read Certificate Store Entries': { + 'ipapermlocation': DN('cn=certificates,cn=ipa,cn=etc', api.env.basedn), + 'ipapermtargetfilter': {'(objectclass=ipacertificate)'}, + 'ipapermbindruletype': 'anonymous', + 'ipapermright': {'read', 'search', 'compare'}, + 'ipapermdefaultattr': { + 'cn', 'objectclass', 'ipacertsubject', 'ipacertissuerserial', + 'ipapublickey', 'ipaconfigstring', 'cacertificate', 'ipakeytrust', + 'ipakeyusage', 'ipakeyextusage', + }, + }, + 'System: Add Certificate Store Entry': { + 'ipapermlocation': DN('cn=certificates,cn=ipa,cn=etc', api.env.basedn), + 'ipapermtargetfilter': {'(objectclass=ipacertificate)'}, + 'ipapermbindruletype': 'permission', + 'ipapermright': {'add'}, + 'default_privileges': {'Certificate Administrators'}, + }, + 'System: Modify Certificate Store Entry': { + 'ipapermlocation': DN('cn=certificates,cn=ipa,cn=etc', api.env.basedn), + 'ipapermtargetfilter': {'(objectclass=ipacertificate)'}, + 'ipapermbindruletype': 'permission', + 'ipapermright': {'write'}, + 'ipapermdefaultattr': { + 'ipacertissuerserial', 'ipaconfigstring', 'cacertificate', + 'ipakeytrust', 'ipakeyusage', 'ipakeyextusage', + }, + 'default_privileges': {'Certificate Administrators'}, + }, + 'System: Remove Certificate Store Entry': { + 'ipapermlocation': DN('cn=certificates,cn=ipa,cn=etc', api.env.basedn), + 'ipapermtargetfilter': {'(objectclass=ipacertificate)'}, + 'ipapermbindruletype': 'permission', + 'ipapermright': {'delete'}, + 'default_privileges': {'Certificate Administrators'}, + }, 'System: Read Replication Information': { 'replaces_global_anonymous_aci': True, 'ipapermlocation': DN('cn=replication,cn=etc', api.env.basedn), |