From 2f3ab2914a2522ab97b455d83b809530dac37f04 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 6 Jan 2014 14:04:19 +0100 Subject: permission plugin: Generate ACIs in the plugin Construct the ACI string from permission entry directly in the permission plugin. This is the next step in moving away from ipalib.aci. Reviewed-By: Martin Kosek --- ipalib/plugins/permission.py | 33 +++++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 10 deletions(-) (limited to 'ipalib/plugins/permission.py') diff --git a/ipalib/plugins/permission.py b/ipalib/plugins/permission.py index 00825e559..875a9f5b1 100644 --- a/ipalib/plugins/permission.py +++ b/ipalib/plugins/permission.py @@ -340,31 +340,44 @@ class permission(baseldap.LDAPObject): def make_aci(self, entry): """Make an ACI string from the given permission entry""" - aci = ACI() + aci_parts = [] name = entry.single_value['cn'] - aci.name = 'permission:%s' % name + + # targetattr + attrs = entry.get('ipapermallowedattr', []) + if attrs: + aci_parts.append("(targetattr = \"%s\")" % ' || '.join(attrs)) + + # target ipapermtarget = entry.single_value.get('ipapermtarget') if ipapermtarget: - aci.set_target('ldap:///%s' % ipapermtarget) + aci_parts.append("(target = \"%s\")" % + 'ldap:///%s' % ipapermtarget) + + # targetfilter ipapermtargetfilter = entry.single_value.get('ipapermtargetfilter') if ipapermtargetfilter: - aci.set_target_filter(ipapermtargetfilter) + assert (ipapermtargetfilter.startswith('(') + and ipapermtargetfilter.endswith(')')) + aci_parts.append("(targetfilter = \"%s\")" % ipapermtargetfilter) + # version, name, rights, bind rule ipapermbindruletype = entry.single_value.get('ipapermbindruletype', 'permission') if ipapermbindruletype == 'permission': dn = DN(('cn', name), self.container_dn, self.api.env.basedn) - aci.set_bindrule('groupdn = "ldap:///%s"' % dn) + bindrule = 'groupdn = "ldap:///%s"' % dn elif ipapermbindruletype == 'all': - aci.set_bindrule('userdn = "ldap:///all"') + bindrule = 'userdn = "ldap:///all"' elif ipapermbindruletype == 'anonymous': - aci.set_bindrule('userdn = "ldap:///anyone"') + bindrule = 'userdn = "ldap:///anyone"' else: raise ValueError(ipapermbindruletype) - aci.permissions = entry['ipapermright'] - aci.set_target_attr(entry.get('ipapermallowedattr', [])) - return aci.export_to_string() + aci_parts.append('(version 3.0;acl "permission:%s";allow (%s) %s;)' % ( + name, ','.join(entry['ipapermright']), bindrule)) + + return ''.join(aci_parts) def add_aci(self, permission_entry): """Add the ACI coresponding to the given permission entry""" -- cgit