diff options
| author | Jan Cholasta <jcholast@redhat.com> | 2014-03-19 14:11:23 +0100 |
|---|---|---|
| committer | Petr Viktorin <pviktori@redhat.com> | 2014-07-30 16:04:21 +0200 |
| commit | 2870db79135e75b66b288838b20d4b40f9007bb9 (patch) | |
| tree | c88d34d025a64b50cd12e306d403daf883f52274 /ipaserver | |
| parent | 031b2819217b540b35ce6fb1dc4a7d73db29d5da (diff) | |
| download | freeipa-2870db79135e75b66b288838b20d4b40f9007bb9.tar.gz freeipa-2870db79135e75b66b288838b20d4b40f9007bb9.tar.xz freeipa-2870db79135e75b66b288838b20d4b40f9007bb9.zip | |
Add permissions for CA certificate renewal.
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Diffstat (limited to 'ipaserver')
| -rw-r--r-- | ipaserver/install/plugins/update_managed_permissions.py | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/ipaserver/install/plugins/update_managed_permissions.py b/ipaserver/install/plugins/update_managed_permissions.py index 8c83b1ccc..608ff8913 100644 --- a/ipaserver/install/plugins/update_managed_permissions.py +++ b/ipaserver/install/plugins/update_managed_permissions.py @@ -129,6 +129,29 @@ NONOBJECT_PERMISSIONS = { 'cn', 'objectclass', 'usercertificate', }, }, + 'System: Add CA Certificate For Renewal': { + 'ipapermlocation': DN('cn=ca_renewal,cn=ipa,cn=etc', api.env.basedn), + 'ipapermtarget': DN( + 'cn=caSigningCert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc', + api.env.basedn), + 'ipapermtargetfilter': {'(objectclass=pkiuser)'}, + 'ipapermbindruletype': 'permission', + 'ipapermright': {'add'}, + 'default_privileges': {'Certificate Administrators'}, + }, + 'System: Modify CA Certificate For Renewal': { + 'ipapermlocation': DN('cn=ca_renewal,cn=ipa,cn=etc', api.env.basedn), + 'ipapermtarget': DN( + 'cn=caSigningCert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc', + api.env.basedn), + 'ipapermtargetfilter': {'(objectclass=pkiuser)'}, + 'ipapermbindruletype': 'permission', + 'ipapermright': {'write'}, + 'ipapermdefaultattr': { + 'usercertificate', + }, + 'default_privileges': {'Certificate Administrators'}, + }, 'System: Read CA Certificate': { 'replaces_global_anonymous_aci': True, 'ipapermlocation': DN('cn=CAcert,cn=ipa,cn=etc', api.env.basedn), |