diff options
-rw-r--r-- | install/share/delegation.ldif | 72 | ||||
-rw-r--r-- | install/updates/40-delegation.update | 16 | ||||
-rw-r--r-- | install/updates/45-roles.update | 6 | ||||
-rw-r--r-- | ipalib/plugins/user.py | 91 |
4 files changed, 91 insertions, 94 deletions
diff --git a/install/share/delegation.ldif b/install/share/delegation.ldif index 43d13974f..2c712bfc1 100644 --- a/install/share/delegation.ldif +++ b/install/share/delegation.ldif @@ -133,65 +133,6 @@ description: Host Enrollment # Default permissions. ############################################ -# User administration - -dn: cn=Add Users,cn=permissions,cn=pbac,$SUFFIX -changetype: add -objectClass: top -objectClass: groupofnames -objectClass: ipapermission -cn: Add Users -member: cn=User Administrators,cn=privileges,cn=pbac,$SUFFIX - -dn: cn=Change a user password,cn=permissions,cn=pbac,$SUFFIX -changetype: add -objectClass: top -objectClass: groupofnames -objectClass: ipapermission -cn: Change a user password -member: cn=User Administrators,cn=privileges,cn=pbac,$SUFFIX - -dn: cn=Add user to default group,cn=permissions,cn=pbac,$SUFFIX -changetype: add -objectClass: top -objectClass: groupofnames -objectClass: ipapermission -cn: Add user to default group -member: cn=User Administrators,cn=privileges,cn=pbac,$SUFFIX - -dn: cn=Unlock user accounts,cn=permissions,cn=pbac,$SUFFIX -changetype: add -objectclass: top -objectclass: groupofnames -objectClass: ipapermission -cn: Unlock user accounts -member: cn=User Administrators,cn=privileges,cn=pbac,$SUFFIX -member: cn=admins,cn=groups,cn=accounts,$SUFFIX - -dn: cn=Remove Users,cn=permissions,cn=pbac,$SUFFIX -changetype: add -objectClass: top -objectClass: groupofnames -objectClass: ipapermission -cn: Remove Users -member: cn=User Administrators,cn=privileges,cn=pbac,$SUFFIX - -dn: cn=Modify Users,cn=permissions,cn=pbac,$SUFFIX -changetype: add -objectClass: top -objectClass: groupofnames -objectClass: ipapermission -cn: Modify Users -member: cn=User Administrators,cn=privileges,cn=pbac,$SUFFIX - -dn: cn=Manage User SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX -changetype: add -objectClass: top -objectClass: groupofnames -objectClass: ipapermission -cn: Manage User SSH Public Keys -member: cn=User Administrators,cn=privileges,cn=pbac,$SUFFIX - # Group administration dn: cn=Add Groups,cn=permissions,cn=pbac,$SUFFIX @@ -521,19 +462,6 @@ member: cn=Replication Administrators,cn=privileges,cn=pbac,$SUFFIX # Default permissions (ACIs) ############################################ -# User administration - -dn: $SUFFIX -changetype: modify -add: aci -aci: (target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Add Users";allow (add) groupdn = "ldap:///cn=Add Users,cn=permissions,cn=pbac,$SUFFIX";) -aci: (targetfilter = "(!(memberOf=cn=admins,cn=groups,cn=accounts,$SUFFIX))")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword || passwordhistory")(version 3.0;acl "permission:Change a user password";allow (write) groupdn = "ldap:///cn=Change a user password,cn=permissions,cn=pbac,$SUFFIX";) -aci: (targetattr = "krbLastAdminUnlock || krbLoginFailedCount")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Unlock user accounts";allow (write) groupdn = "ldap:///cn=Unlock user accounts,cn=permissions,cn=pbac,$SUFFIX";) -aci: (targetattr = "member")(target = "ldap:///cn=ipausers,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Add user to default group";allow (write) groupdn = "ldap:///cn=Add user to default group,cn=permissions,cn=pbac,$SUFFIX";) -aci: (target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Remove Users";allow (delete) groupdn = "ldap:///cn=Remove Users,cn=permissions,cn=pbac,$SUFFIX";) -aci: (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou || mepmanagedentry || objectclass")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Users";allow (write) groupdn = "ldap:///cn=Modify Users,cn=permissions,cn=pbac,$SUFFIX";) -aci: (targetattr = "ipasshpubkey")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage User SSH Public Keys";allow (write) groupdn = "ldap:///cn=Manage User SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX";) - # Group administration dn: $SUFFIX diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update index 3f3b98799..7c3a284b8 100644 --- a/install/updates/40-delegation.update +++ b/install/updates/40-delegation.update @@ -307,14 +307,6 @@ add:aci:'(targetattr = "automountkey || automountinformation || description")(ta replace:aci:'(target = "ldap:///automountkey=*,automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Add Automount keys";allow (add) groupdn = "ldap:///cn=Add Automount keys,cn=permissions,cn=pbac,$SUFFIX";)::(targetfilter = "(objectclass=automount)")(target = "ldap:///automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Add Automount keys";allow (add) groupdn = "ldap:///cn=Add Automount keys,cn=permissions,cn=pbac,$SUFFIX";)' replace:aci:'(target = "ldap:///automountkey=*,automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Remove Automount keys";allow (delete) groupdn = "ldap:///cn=Remove Automount keys,cn=permissions,cn=pbac,$SUFFIX";)::(targetfilter = "(objectclass=automount)")(target = "ldap:///automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Remove Automount keys";allow (delete) groupdn = "ldap:///cn=Remove Automount keys,cn=permissions,cn=pbac,$SUFFIX";)' -# SSH public keys -dn: cn=Manage User SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX -default:objectClass: top -default:objectClass: groupofnames -default:objectClass: ipapermission -default:cn: Manage User SSH Public Keys -default:member: cn=User Administrators,cn=privileges,cn=pbac,$SUFFIX - dn: cn=Manage Host SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX default:objectClass: top default:objectClass: groupofnames @@ -323,16 +315,8 @@ default:cn: Manage Host SSH Public Keys default:member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX dn: $SUFFIX -add:aci:'(targetattr = "ipasshpubkey")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage User SSH Public Keys";allow (write) groupdn = "ldap:///cn=Manage User SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX";)' - -dn: $SUFFIX add:aci:'(targetattr = "ipasshpubkey")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=Manage Host SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX";)' -# Limit the change password permission so it can't change the passwords -# of administrators -dn: $SUFFIX -replace:aci:'(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword || passwordhistory")(version 3.0;acl "permission:Change a user password";allow (write) groupdn = "ldap:///cn=Change a user password,cn=permissions,cn=pbac,$SUFFIX";)::(targetfilter = "(!(memberOf=cn=admins,cn=groups,cn=accounts,$SUFFIX))")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword || passwordhistory")(version 3.0;acl "permission:Change a user password";allow (write) groupdn = "ldap:///cn=Change a user password,cn=permissions,cn=pbac,$SUFFIX";)' - # Don't allow the default 'manage group membership' to be able to manage the # admins group replace:aci:'(targetattr = "member")(target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Group membership";allow (write) groupdn = "ldap:///cn=Modify Group membership,cn=permissions,cn=pbac,$SUFFIX";)::(targetfilter = "(!(cn=admins))")(targetattr = "member")(target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Group membership";allow (write) groupdn = "ldap:///cn=Modify Group membership,cn=permissions,cn=pbac,$SUFFIX";)' diff --git a/install/updates/45-roles.update b/install/updates/45-roles.update index 3803cee3b..a3cbf4ddc 100644 --- a/install/updates/45-roles.update +++ b/install/updates/45-roles.update @@ -7,12 +7,6 @@ default:cn: Modify Users and Reset passwords default:description: Modify Users and Reset passwords default:member: cn=helpdesk,cn=roles,cn=accounts,$SUFFIX -dn: cn=Change a user password,cn=permissions,cn=pbac,$SUFFIX -add:member: 'cn=Modify Users and Reset passwords,cn=privileges,cn=pbac,$SUFFIX' - -dn: cn=Modify Users,cn=permissions,cn=pbac,$SUFFIX -add:member: 'cn=Modify Users and Reset passwords,cn=privileges,cn=pbac,$SUFFIX' - dn: cn=Modify Group membership,cn=privileges,cn=pbac,$SUFFIX default:objectClass: top default:objectClass: groupofnames diff --git a/ipalib/plugins/user.py b/ipalib/plugins/user.py index 27ad36b7f..071cda5aa 100644 --- a/ipalib/plugins/user.py +++ b/ipalib/plugins/user.py @@ -336,6 +336,97 @@ class user(LDAPObject): 'ipapermdefaultattr': {'*'}, 'default_privileges': {'User Administrators'}, }, + 'System: Add Users': { + 'ipapermbindruletype': 'permission', + 'ipapermright': {'add'}, + 'replaces': [ + '(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Add Users";allow (add) groupdn = "ldap:///cn=Add Users,cn=permissions,cn=pbac,$SUFFIX";)', + ], + 'default_privileges': {'User Administrators'}, + }, + 'System: Add User to default group': { + 'non_object': True, + 'ipapermbindruletype': 'permission', + 'ipapermright': {'write'}, + 'ipapermlocation': DN(api.env.container_group, api.env.basedn), + 'ipapermtarget': DN('cn=ipausers', api.env.container_group, + api.env.basedn), + 'ipapermdefaultattr': {'member'}, + 'replaces': [ + '(targetattr = "member")(target = "ldap:///cn=ipausers,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Add user to default group";allow (write) groupdn = "ldap:///cn=Add user to default group,cn=permissions,cn=pbac,$SUFFIX";)', + ], + 'default_privileges': {'User Administrators'}, + }, + 'System: Change User password': { + 'ipapermbindruletype': 'permission', + 'ipapermright': {'write'}, + 'ipapermtargetfilter': [ + '(objectclass=posixaccount)', + '(!(memberOf=%s))' % DN('cn=admins', + api.env.container_group, + api.env.basedn), + ], + 'ipapermdefaultattr': { + 'krbprincipalkey', 'passwordhistory', 'sambalmpassword', + 'sambantpassword', 'userpassword' + }, + 'replaces': [ + '(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword || passwordhistory")(version 3.0;acl "permission:Change a user password";allow (write) groupdn = "ldap:///cn=Change a user password,cn=permissions,cn=pbac,$SUFFIX";)', + '(targetfilter = "(!(memberOf=cn=admins,cn=groups,cn=accounts,$SUFFIX))")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword || passwordhistory")(version 3.0;acl "permission:Change a user password";allow (write) groupdn = "ldap:///cn=Change a user password,cn=permissions,cn=pbac,$SUFFIX";)', + ], + 'default_privileges': { + 'User Administrators', + 'Modify Users and Reset passwords', + }, + }, + 'System: Manage User SSH Public Keys': { + 'ipapermbindruletype': 'permission', + 'ipapermright': {'write'}, + 'ipapermdefaultattr': {'ipasshpubkey'}, + 'replaces': [ + '(targetattr = "ipasshpubkey")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage User SSH Public Keys";allow (write) groupdn = "ldap:///cn=Manage User SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX";)', + ], + 'default_privileges': {'User Administrators'}, + }, + 'System: Modify Users': { + 'ipapermbindruletype': 'permission', + 'ipapermright': {'write'}, + 'ipapermdefaultattr': { + 'businesscategory', 'carlicense', 'cn', 'description', + 'displayname', 'employeetype', 'facsimiletelephonenumber', + 'gecos', 'givenname', 'homephone', 'inetuserhttpurl', + 'initials', 'l', 'labeleduri', 'loginshell', 'manager', + 'mepmanagedentry', 'mobile', 'objectclass', 'ou', 'pager', + 'postalcode', 'roomnumber', 'secretary', 'seealso', 'sn', 'st', + 'street', 'telephonenumber', 'title' + }, + 'replaces': [ + '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou || mepmanagedentry || objectclass")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Users";allow (write) groupdn = "ldap:///cn=Modify Users,cn=permissions,cn=pbac,$SUFFIX";)', + ], + 'default_privileges': { + 'User Administrators', + 'Modify Users and Reset passwords', + }, + }, + 'System: Remove Users': { + 'ipapermbindruletype': 'permission', + 'ipapermright': {'delete'}, + 'replaces': [ + '(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Remove Users";allow (delete) groupdn = "ldap:///cn=Remove Users,cn=permissions,cn=pbac,$SUFFIX";)', + ], + 'default_privileges': {'User Administrators'}, + }, + 'System: Unlock User': { + 'ipapermbindruletype': 'permission', + 'ipapermright': {'write'}, + 'ipapermdefaultattr': { + 'krblastadminunlock', 'krbloginfailedcount' + }, + 'replaces': [ + '(targetattr = "krbLastAdminUnlock || krbLoginFailedCount")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Unlock user accounts";allow (write) groupdn = "ldap:///cn=Unlock user accounts,cn=permissions,cn=pbac,$SUFFIX";)', + ], + 'default_privileges': {'User Administrators'}, + }, } label = _('Users') |