summaryrefslogtreecommitdiffstats
path: root/ipalib/plugins/permission.py
Commit message (Collapse)AuthorAgeFilesLines
...
* Explicitly filter options that permission-{add,mod} passes to aci-{add,mod}Petr Viktorin2012-07-021-10/+9
| | | | | | | | | | | Make permission commands not pass options that the underlying ACI commands do not understand. Update tests. Remove some extraneous imports of the `copy` module. https://fedorahosted.org/freeipa/ticket/2885
* Per-domain DNS record permissionsMartin Kosek2012-06-281-1/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
* Fail on unknown Command optionsPetr Viktorin2012-06-201-17/+30
| | | | | | | | | | | | | | | | | | When unknown keyword arguments are passed to a Command, raise an error instead of ignoring them. Options used when IPA calls its commands internally are listed in a new Command attribute called internal_options, and allowed. Previous patches (0b01751c, c45174d6, c5689e7f) made IPA not use unknown keyword arguments in its own commands and tests, but since that some violations were reintroduced in permission_find and tests. Fix those. Tests included; both a frontend unittest and a XML-RPC test via the ping plugin (which was untested previously). https://fedorahosted.org/freeipa/ticket/2509
* permission-find missed some results with --pkey-only optionMartin Kosek2012-06-011-14/+20
| | | | | | | | | | | | | When permission-find post callback detected a --pkey-only option, it just terminated. However, this way the results that could have been added from aci_find matches were not included. Fix the post callback to go through the entire matching process. Also make sure that DNS permissions have a correct objectclass (ipapermission), otherwise such objects are not matched by the permission LDAP search. https://fedorahosted.org/freeipa/ticket/2658
* Enforce sizelimit in permission-find, post_callback returns truncatedRob Crittenden2012-05-301-2/+16
| | | | | | | | | | | | | | | We actually perform two searches in permission-find. The first looks for matches within the permission object itself. The second looks at matches in the underlying aci. We need to break out in two places. The first is if we find enough matches in the permission itself. The second when we are appending matches from acis. The post_callback() definition needed to be modified to return the truncated value so a plugin author can modify that value. https://fedorahosted.org/freeipa/ticket/2322
* permission-mod prompts for all parametersOndrej Hamada2012-05-171-14/+7
| | | | | | | | | ipa permission-mod was prompting for all parameters because they had specified flag 'ask_update'. The flag was removed. Additionally the exec_callback for permission-mod was updated to unify the behaviour with other ipa commands (raise exception when no modification was specified). https://fedorahosted.org/freeipa/ticket/2280
* Do not use extra command options in ACI, permission, selfservicePetr Viktorin2012-05-141-19/+14
| | | | | | | | | | | Allowing Commands to be called with ignored unknown options opens the door to problems, for example with misspelled option names. Before we start rejecting them, we need to make sure IPA itself does not use them when it calls commands internally. This patch does that for ACI-related plugins. Part of the work for https://fedorahosted.org/freeipa/ticket/2509
* Fix overlapping cn param/option issue, pass cn as aciname in findRob Crittenden2012-05-141-0/+7
| | | | | | | | | | | | permission-find --name wasn't working for two reasons. The first was that the cn to search on in options ended up overlapping the primary key name causing the request to fail. The second reason was aci uses aciname, not cn, as its name field. So searching on --name matched everything because it was as if you were searching on nothing. https://fedorahosted.org/freeipa/ticket/2320
* Revert "Validate attributes in permission-add"Rob Crittenden2012-04-291-56/+0
| | | | | | | | This reverts commit 1356988b7a40a60af39807db143860efb4a2f435. We are going to take another approach to this. Instead of erroring out on attributes that don't seem to be allowed we are going to eventually return a warning.
* Refactor exc_callback invocation.Jan Cholasta2012-04-261-14/+13
| | | | | | | | | Replace _call_exc_callbacks with a function wrapper, which will automatically call exception callbacks when an exception is raised from the function. This removes the need to specify the function and its arguments twice (once in the function call itself and once in _call_exc_callbacks). Add some extra checks to existing exception callbacks.
* Unable to rename permission objectOndrej Hamada2012-04-111-8/+11
| | | | | | | The update was failing because of the case insensitivity of permission object DN. Unit-tests added. https://fedorahosted.org/freeipa/ticket/2571
* Limit permission and selfservice names to alphanumerics, -, _, spacePetr Viktorin2012-04-091-0/+4
| | | | | | | | The DN and ACI code doesn't always escape special characters properly. Rather than trying to fix it, this patch takes the easy way out and enforces that the names are safe. https://fedorahosted.org/freeipa/ticket/2585
* Only apply validation rules when adding and updating.Rob Crittenden2012-02-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There may be cases, for whatever reason, that an otherwise illegal entry gets created that doesn't match the criteria for a valid user/host/group name. If this happens (i.e. migration) there is no way to remove this using the IPA tools because we always applied the name pattern. So you can't, for example, delete a user with an illegal name. Primary keys are cloned with query=True in PKQuery which causes no rules to be applied on mod/show/find. This reverts a change from commit 3a5e26a0 which applies class rules when query=True (for enforcing no white space). Replace rdnattr with rdn_is_primary_key. This was meant to tell us when an RDN change was necessary to do a rename. There could be a disconnect where the rdnattr wasn't the primary key and in that case we don't need to do an RDN change, so use a boolean instead so that it is clear that RDN == primary key. Add a test to ensure that nowhitespace is actually enforced. https://fedorahosted.org/freeipa/ticket/2115 Related: https://fedorahosted.org/freeipa/ticket/2089 Whitespace tickets: https://fedorahosted.org/freeipa/ticket/1285 https://fedorahosted.org/freeipa/ticket/1286 https://fedorahosted.org/freeipa/ticket/1287
* Validate attributes in permission-addOndrej Hamada2012-02-281-0/+55
| | | | | | | | | | | When adding or modifying permission with both type and attributes specified, check whether the attributes are allowed for specified type. In case of disallowed attributes raises the ObjectclassViolation exception. New tests were also added to the unit-tests. https://fedorahosted.org/freeipa/ticket/2293
* Remove debug messagesMartin Kosek2012-02-061-4/+0
| | | | | | | https://fedorahosted.org/freeipa/ticket/2010 https://fedorahosted.org/freeipa/ticket/2323 https://fedorahosted.org/freeipa/ticket/2228 https://fedorahosted.org/freeipa/ticket/2232
* Fix raw format for ACI commandsMartin Kosek2012-02-031-13/+23
| | | | | | | | | | | | | ACI plugins (permission, selfservice and delegation) were not prepared to serve ACIs in a raw format, i.e. raw "aci" attribute taken from LDAP. This patch fixes all these plugins and their commands to provide provide this format. Few ACI raw format unit tests were added for all these plugins. https://fedorahosted.org/freeipa/ticket/2010 https://fedorahosted.org/freeipa/ticket/2223 https://fedorahosted.org/freeipa/ticket/2228 https://fedorahosted.org/freeipa/ticket/2232
* Display the value of memberOf ACIs in permission plugin.Rob Crittenden2012-01-041-2/+2
| | | | | | | | | | | | | | | | There were two problems: 1. memberof wasn't in the list of things we looked for in the return value from aci_show() 2. The value wasn't being translated into a group name. Use the DN class to retrieve the group name from the memberof URI. Note that I changed the parsing for targetgroup as well. We now save a lookup and potentially returning a NotFound if an aci points to a group that no longer exists. https://fedorahosted.org/freeipa/ticket/2100
* Parse comma-separated lists of values in all parameter types. This can be ↵Jan Cholasta2011-11-301-2/+4
| | | | | | | | | | | | | enabled for a specific parameter by setting the "csv" option to True. Remove "List" parameter type and replace all occurences of it with appropriate multi-valued parameter ("Str" in most cases) with csv enabled. Add new parameter type "Any", capable of holding values of any type. This is needed by the "batch" command, as "Str" is not suitable type for the "methods" parameter. ticket 2007
* Create pkey-only option for find commandsMartin Kosek2011-10-271-0/+2
| | | | | | | | | | | | New option --pkey-only is available for all LDAPSearch based classes with primary key visible in the output. This option makes LDAPSearch commands search for primary attribute only. This may be useful when manipulating large data sets. User can at first retrieve all primary keys in a relatively small data package and then run further commands with retrieved primary keys. https://fedorahosted.org/freeipa/ticket/1262
* Remove normalizer that made role, privilege and permission names lower-caseRob Crittenden2011-09-121-1/+0
| | | | https://fedorahosted.org/freeipa/ticket/1747
* ticket 1669 - improve i18n docstring extractionJohn Dennis2011-08-241-24/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
* Fixed label capitalizationEndi S. Dewata2011-07-141-1/+1
| | | | | | | | The CSS text-transform sometimes produces incorrect capitalization, so the code has been modified to use translated labels that already contain the correct capitalization. Ticket #1424
* Fixed object_name and object_name_plural internationalizationEndi S. Dewata2011-07-121-2/+2
| | | | | | | | | The object_name, object_name_plural and messages that use these attributes have been converted to support translation. The label attribute in the Param class has been modified to accept unicode string. Ticket #1435
* Added singular entity labels.Endi S. Dewata2011-06-271-0/+1
| | | | | | | | | | | | | | | A new attribute label_singular has been added to all entities which contains the singular form of the entity label in lower cases except for acronyms (e.g. HBAC) or proper nouns (e.g. Kerberos). In the Web UI, this label can be capitalized using CSS text-transform. The existing 'label' attribute is intentionally left unchanged due to inconsistencies in the current values. It contains mostly the plural form of capitalized entity label, but some are singular. Also, it seems currently there is no comparable capitalization method on the server-side. So more work is needed before the label can be changed. Ticket #1249
* Provide attributelevelrights for the aci components in permission_show.Rob Crittenden2011-04-211-1/+6
| | | | | | | Since the broken-out components are just part of the aci just copy right access rights for aci. ticket 943
* Fix style and grammatical issues in built-in command help.Rob Crittenden2011-03-041-5/+6
| | | | | | | There is a rather large API.txt change but it is only due to changes in the doc string in parameters. ticket 729
* Fix translatable strings in ipalib plugins.Pavel Zuna2011-03-011-1/+1
| | | | Needed for xgettext/pygettext processing.
* Make permission and privilege help text clearerRob Crittenden2011-02-231-4/+5
| | | | ticket 996
* Changed dns permission typesJan Zeleny2011-02-141-1/+1
| | | | | | | | Recent change of DNS module to version caused that dns object type was replaced by dnszone and dnsrecord. This patch corrects dns types in permissions class. https://fedorahosted.org/freeipa/ticket/646
* Add new schema to store information about permissions.Rob Crittenden2011-02-011-2/+28
| | | | | | | | | There are some permissions we can't display because they are stored outside of the basedn (such as the replication permissions). We are adding a new attribute to store extra information to make this clear, in this case SYSTEM. ticket 853
* Rename permissions and privileges to be more readable.Rob Crittenden2011-01-311-20/+16
| | | | | | | This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
* Fixed permission lookupJan Zeleny2011-01-311-4/+1
| | | | | | | | Lookup based on --filter wasn't implemented at all. It did't show until now, because of bug sitting on top of it which was resulting in internal error. This patch fixes the bug and adds the filtering functionality. https://fedorahosted.org/freeipa/ticket/818
* ipa permission-mod --rename does not workMartin Kosek2011-01-281-5/+22
| | | | | | | | | | | This patch fixes nonfunctional rename operation in permission plugin. Also makes sure, that no change is made to the underlying ACI in pre_callback() when the target permission already exists. Several tests for the rename operation have been created to ensure that the it won't break again unnoticed. https://fedorahosted.org/freeipa/ticket/814
* ACI plugin supports prefixesMartin Kosek2011-01-261-22/+33
| | | | | | | | | | | | | | | | | | | | | | | | When more than one plugin produce ACIs, they share common namespace of ACI name. This may lead to name collisions between the ACIs from different plugins. This patch introduces a mandatory "prefix" attribute for non-find ACI operations which allow plugins to use their own prefixes (i.e. namespaces) which is then used when a name of the ACI is generated. Permission, Delegation and Selfservice plugins has been updated to use their own prefixes thus avoiding name collisions by using their own namespaces. Default ACIs in LDIFs has been updated to follow this new policy. Permission plugin now uses its CN (=primary key) instead of description in ACI names as Description may not be unique. This change requires an IPA server reinstall since the default ACI set has been changed. https://fedorahosted.org/freeipa/ticket/764
* Add flags to enforce asking for object attributeJan Zeleny2011-01-261-6/+6
| | | | | | | So far the only flag to enforce asking in interactive mode was the alwaysask attribute, which is not sufficient any more. This patch adds the ability to control for which actions the atrribute shall be asked for.
* Make ipa permission-add ask for optional attributesJan Zeleny2011-01-211-0/+6
| | | | | | | Either one of type, filter, subtree, targetgroup, attrs or memberof is required. https://fedorahosted.org/freeipa/ticket/819
* Rename INTERNAL to NO_CLI for commands we hide from the cli.Rob Crittenden2011-01-211-2/+2
| | | | | | Also make i18n_messages and json_metadata NO_CLI. ticket 821
* Fix 'ipa help permissions'; add 'dns' in allowed types.Pavel Zuna2011-01-071-1/+1
|
* Change FreeIPA license to GPLv3+Jakub Hrozek2010-12-201-5/+5
| | | | | | | | | | The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
* Don't use camel-case LDAP attributes in ACI and don't clear enrolledByRob Crittenden2010-12-171-0/+1
| | | | | | | | | | | | We keep LDAP attributes lower-case elsewhere in the API we should do the same with all access controls. There were two ACIs pointing at the manage_host_keytab permission. This isn't allowed in general and we have decided separately to not clear out enrolledBy when a host is unenrolled so dropping it is the obvious thing to do. ticket 597
* Catch ACI errors better when adding a permission.Rob Crittenden2010-12-171-3/+17
| | | | | | | | We create the aci with the --test flag to test its validity but it doesn't do the same level of tests that actually adding an aci to LDAP does. Catch any syntax errors that get thrown and clean up as best we can. ticket 621
* Fix the change_password permissions and the DNS access controls.Rob Crittenden2010-12-171-1/+1
| | | | | | | | | | The change_password permission was too broad, limit it to users. The DNS access controls rolled everything into a single ACI. I broke it out into separate ACIs for add, delete and add. I also added a new dns type for the permission plugin. ticket 628
* Better handle permission object updates versus aci object updates.Rob Crittenden2010-12-131-7/+10
| | | | | | | | | permissions are a real group pointed to by an aci, managed by the same plugin. Any given update can update one or both or neither. Do a better job at determining what it is that needs to be updated and handle the case where only the ACI is updated so that EmptyModList is not thrown. ticket 603
* Add plugin for manage self-service ACIsRob Crittenden2010-12-081-1/+2
| | | | | | | | | This is just a thin wrapper around the aci plugin, controlling what types of ACIs can be added. Right now only ACIs in the basedn can be managed with this plugin. ticket 531
* Re-implement access control using an updated model.Rob Crittenden2010-12-011-0/+363
The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
generated by cgit (git 2.34.1) at 2025-08-28 01:57:17 +0000