Add an editors group. This is used to generally grant access for users

to edit other users (the Edit link won't appear otherwise). Additional
delegation is need to grant permission to individual attributes.
Update the failed login page to indicate that it is a permission issue.
Don't allow access to policy at all for non-admins.
By default users can only edit themselves.

1 files changed, 5 insertions, 5 deletions

diff --git a/ipa-server/ipa-gui/ipagui/subcontrollers/delegation.py b/ipa-server/ipa-gui/ipagui/subcontrollers/delegation.py
index d7149265..142d3443 100644
--- a/ipa-server/ipa-gui/ipagui/subcontrollers/delegation.py
+++ b/ipa-server/ipa-gui/ipagui/subcontrollers/delegation.py
@@ -35,7 +35,7 @@ class DelegationController(IPAController):
         raise turbogears.redirect("/delegate/list")
 
     @expose("ipagui.templates.delegatenew")
-    @identity.require(identity.not_anonymous())
+    @identity.require(identity.in_group("admins"))
     def new(self):
         """Display delegate page"""
         client = self.get_ipaclient()
@@ -46,7 +46,7 @@ class DelegationController(IPAController):
         return dict(form=delegate_form, delegate=delegate)
 
     @expose()
-    @identity.require(identity.not_anonymous())
+    @identity.require(identity.in_group("admins"))
     def create(self, **kw):
         """Creates a new delegation"""
         self.restrict_post()
@@ -107,7 +107,7 @@ class DelegationController(IPAController):
         raise turbogears.redirect('/delegate/list')
 
     @expose("ipagui.templates.delegateedit")
-    @identity.require(identity.not_anonymous())
+    @identity.require(identity.in_group("admins"))
     def edit(self, acistr, tg_errors=None):
         """Display delegate page"""
         if tg_errors:
@@ -134,7 +134,7 @@ class DelegationController(IPAController):
 
 
     @expose()
-    @identity.require(identity.not_anonymous())
+    @identity.require(identity.in_group("admins"))
     def update(self, **kw):
         """Display delegate page"""
         self.restrict_post()
@@ -230,7 +230,7 @@ class DelegationController(IPAController):
                     fields=ipagui.forms.delegate.DelegateFields())
 
     @expose()
-    @identity.require(identity.not_anonymous())
+    @identity.require(identity.in_group("admins"))
     def delete(self, acistr):
         """Display delegate page"""
         self.restrict_post()