From 9793e44380f8fcdefa1a33fad5fad30ac9a9ac3f Mon Sep 17 00:00:00 2001 From: Tomas Babej Date: Thu, 31 Jul 2014 13:13:29 +0200 Subject: idvies: Add managed permissions for idview and idoverride objects Part of: https://fedorahosted.org/freeipa/ticket/3979 --- ACI.txt | 4 ++++ ipalib/plugins/idviews.py | 23 +++++++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/ACI.txt b/ACI.txt index 80b555de8..eb88d31a8 100644 --- a/ACI.txt +++ b/ACI.txt @@ -118,8 +118,12 @@ dn: cn=hostgroups,cn=accounts,dc=ipa,dc=example aci: (targetattr = "businesscategory || cn || createtimestamp || description || entryusn || ipauniqueid || modifytimestamp || o || objectclass || ou || owner || seealso")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Read Hostgroups";allow (compare,read,search) userdn = "ldap:///all";) dn: cn=hostgroups,cn=accounts,dc=ipa,dc=example aci: (targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Remove Hostgroups";allow (delete) groupdn = "ldap:///cn=System: Remove Hostgroups,cn=permissions,cn=pbac,dc=ipa,dc=example";) +dn: cn=views,cn=accounts,dc=ipa,dc=example +aci: (targetattr = "cn || createtimestamp || description || entryusn || gidnumber || homedirectory || ipaanchoruuid || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaOverrideAnchor)")(version 3.0;acl "permission:System: Read ID Overrides";allow (compare,read,search) userdn = "ldap:///all";) dn: cn=ranges,cn=etc,dc=ipa,dc=example aci: (targetattr = "cn || createtimestamp || entryusn || ipabaseid || ipabaserid || ipaidrangesize || ipanttrusteddomainsid || iparangetype || ipasecondarybaserid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidrange)")(version 3.0;acl "permission:System: Read ID Ranges";allow (compare,read,search) userdn = "ldap:///all";) +dn: cn=views,cn=accounts,dc=ipa,dc=example +aci: (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Read ID Views";allow (compare,read,search) userdn = "ldap:///all";) dn: cn=IPA.EXAMPLE,cn=kerberos,dc=ipa,dc=example aci: (targetattr = "createtimestamp || entryusn || krbdefaultencsalttypes || krbmaxrenewableage || krbmaxticketlife || krbsupportedencsalttypes || modifytimestamp || objectclass")(targetfilter = "(objectclass=krbticketpolicyaux)")(version 3.0;acl "permission:System: Read Default Kerberos Ticket Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Default Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=users,cn=accounts,dc=ipa,dc=example diff --git a/ipalib/plugins/idviews.py b/ipalib/plugins/idviews.py index b4909de91..e7a26dea2 100644 --- a/ipalib/plugins/idviews.py +++ b/ipalib/plugins/idviews.py @@ -64,6 +64,17 @@ class idview(LDAPObject): ), ) + permission_filter_objectclasses = ['nsContainer'] + managed_permissions = { + 'System: Read ID Views': { + 'ipapermbindruletype': 'all', + 'ipapermright': {'read', 'search', 'compare'}, + 'ipapermdefaultattr': { + 'cn', 'description', 'objectClass', + }, + }, + } + @register() class idview_add(LDAPCreate): @@ -160,6 +171,18 @@ class idoverride(LDAPObject): ), ) + permission_filter_objectclasses = ['ipaOverrideAnchor'] + managed_permissions = { + 'System: Read ID Overrides': { + 'ipapermbindruletype': 'all', + 'ipapermright': {'read', 'search', 'compare'}, + 'ipapermdefaultattr': { + 'cn', 'objectClass', 'ipaAnchorUUID', 'uidNumber', 'gidNumber', + 'description', 'homeDirectory', 'uid', + }, + }, + } + @register() class idoverride_add(LDAPCreate): -- cgit