diff options
| author | Petr Viktorin <pviktori@redhat.com> | 2013-10-29 17:01:07 +0100 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2014-01-07 09:56:41 +0100 |
| commit | 4a64a1f18bd51c65bf34a13fd7541e1d6b4b75fd (patch) | |
| tree | 8cc1db4e9b3e1b77f25b36ad5c58a1b37d94fea7 /ipalib/plugins/permission.py | |
| parent | d7f5d58d352f31df144de15976bd06c5aa822210 (diff) | |
| download | freeipa.git-4a64a1f18bd51c65bf34a13fd7541e1d6b4b75fd.tar.gz freeipa.git-4a64a1f18bd51c65bf34a13fd7541e1d6b4b75fd.tar.xz freeipa.git-4a64a1f18bd51c65bf34a13fd7541e1d6b4b75fd.zip | |
Allow anonymous and all permissions
Disallow adding permissions with non-default bindtype to privileges
Ticket: https://fedorahosted.org/freeipa/ticket/4032
Design: http://www.freeipa.org/page/V3/Anonymous_and_All_permissions
Diffstat (limited to 'ipalib/plugins/permission.py')
| -rw-r--r-- | ipalib/plugins/permission.py | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/ipalib/plugins/permission.py b/ipalib/plugins/permission.py index fef640c3..20457469 100644 --- a/ipalib/plugins/permission.py +++ b/ipalib/plugins/permission.py @@ -180,7 +180,7 @@ class permission(baseldap.LDAPObject): label=_('Bind rule type'), doc=_('Bind rule type'), autofill=True, - values=(u'permission',), + values=(u'permission', u'all', u'anonymous'), default=u'permission', ), DNOrURL( @@ -775,6 +775,13 @@ class permission_mod(baseldap.LDAPUpdate): self.obj.reject_system(old_entry) self.obj.upgrade_permission(old_entry) + # Check setting bindtype for an assigned permission + if options.get('ipapermbindruletype') and old_entry.get('member'): + raise errors.ValidationError( + name='ipapermbindruletype', + error=_('cannot set bindtype for a permission that is ' + 'assigned to a privilege')) + # Since `entry` only contains the attributes we are currently changing, # it cannot be used directly to generate an ACI. # First we need to copy the original data into it. |