Add permissions for certificate store.

Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>

2 files changed, 76 insertions, 0 deletions

diff --git a/ipaserver/install/plugins/update_managed_permissions.py b/ipaserver/install/plugins/update_managed_permissions.py
index 608ff8913..2051bd4a2 100644
--- a/ipaserver/install/plugins/update_managed_permissions.py
+++ b/ipaserver/install/plugins/update_managed_permissions.py
@@ -163,6 +163,52 @@ NONOBJECT_PERMISSIONS = {
             'authorityrevocationlist', 'crosscertificatepair',
         },
     },
+    'System: Modify CA Certificate': {
+        'ipapermlocation': DN('cn=CAcert,cn=ipa,cn=etc', api.env.basedn),
+        'ipapermtargetfilter': {'(objectclass=pkica)'},
+        'ipapermbindruletype': 'permission',
+        'ipapermright': {'write'},
+        'ipapermdefaultattr': {
+            'cacertificate',
+        },
+        'default_privileges': {'Certificate Administrators'},
+    },
+    'System: Read Certificate Store Entries': {
+        'ipapermlocation': DN('cn=certificates,cn=ipa,cn=etc', api.env.basedn),
+        'ipapermtargetfilter': {'(objectclass=ipacertificate)'},
+        'ipapermbindruletype': 'anonymous',
+        'ipapermright': {'read', 'search', 'compare'},
+        'ipapermdefaultattr': {
+            'cn', 'objectclass', 'ipacertsubject', 'ipacertissuerserial',
+            'ipapublickey', 'ipaconfigstring', 'cacertificate', 'ipakeytrust',
+            'ipakeyusage', 'ipakeyextusage',
+        },
+    },
+    'System: Add Certificate Store Entry': {
+        'ipapermlocation': DN('cn=certificates,cn=ipa,cn=etc', api.env.basedn),
+        'ipapermtargetfilter': {'(objectclass=ipacertificate)'},
+        'ipapermbindruletype': 'permission',
+        'ipapermright': {'add'},
+        'default_privileges': {'Certificate Administrators'},
+    },
+    'System: Modify Certificate Store Entry': {
+        'ipapermlocation': DN('cn=certificates,cn=ipa,cn=etc', api.env.basedn),
+        'ipapermtargetfilter': {'(objectclass=ipacertificate)'},
+        'ipapermbindruletype': 'permission',
+        'ipapermright': {'write'},
+        'ipapermdefaultattr': {
+            'ipacertissuerserial', 'ipaconfigstring', 'cacertificate',
+            'ipakeytrust', 'ipakeyusage', 'ipakeyextusage',
+        },
+        'default_privileges': {'Certificate Administrators'},
+    },
+    'System: Remove Certificate Store Entry': {
+        'ipapermlocation': DN('cn=certificates,cn=ipa,cn=etc', api.env.basedn),
+        'ipapermtargetfilter': {'(objectclass=ipacertificate)'},
+        'ipapermbindruletype': 'permission',
+        'ipapermright': {'delete'},
+        'default_privileges': {'Certificate Administrators'},
+    },
     'System: Read Replication Information': {
         'replaces_global_anonymous_aci': True,
         'ipapermlocation': DN('cn=replication,cn=etc', api.env.basedn),
diff --git a/ipaserver/install/replication.py b/ipaserver/install/replication.py
index f1e70a1d4..5778cab03 100644
--- a/ipaserver/install/replication.py
+++ b/ipaserver/install/replication.py
@@ -1283,6 +1283,36 @@ class ReplicationManager(object):
                 err = e
 
         try:
+            entry = self.conn.get_entry(
+                DN(('cn', 'certificates'), ('cn', 'ipa'), ('cn', 'etc'),
+                   self.suffix),
+                ['aci'])
+
+            sub = {'suffix': self.suffix, 'fqdn': replica}
+            try:
+                entry.raw['aci'].remove(
+                    '(targetfilter = "(&(objectClass=ipaCertificate)'
+                    '(ipaConfigString=ipaCA))")(targetattr = '
+                    '"ipaCertIssuerSerial || cACertificate")(version 3.0; acl '
+                    '"Modify CA Certificate Store Entry"; allow (write) '
+                    'userdn = "ldap:///fqdn=%(fqdn)s,cn=computers,cn=accounts,'
+                    '%(suffix)s";)' % sub)
+            except ValueError:
+                pass
+
+            try:
+                self.conn.update_entry(entry)
+            except errors.EmptyModlist:
+                pass
+        except errors.NotFound:
+            pass
+        except Exception, e:
+            if not force:
+                raise e
+            elif not err:
+                err = e
+
+        try:
             basedn = DN(('cn', 'etc'), self.suffix)
             filter = '(dnaHostname=%s)' % replica
             entries = self.conn.get_entries(