diff options
| author | Stanislav Laznicka <slaznick@redhat.com> | 2016-06-29 15:58:07 +0200 |
|---|---|---|
| committer | Petr Vobornik <pvoborni@redhat.com> | 2016-06-30 16:44:56 +0200 |
| commit | 235b19ba7f9807ecf10436d1a5b28518b4475a70 (patch) | |
| tree | 61111fb6ad7230d59cf4823a98cd81e06bae4804 | |
| parent | 97db87b383b1ae4639bdb51793354bad30adf5a9 (diff) | |
| download | freeipa-235b19ba7f9807ecf10436d1a5b28518b4475a70.tar.gz freeipa-235b19ba7f9807ecf10436d1a5b28518b4475a70.tar.xz freeipa-235b19ba7f9807ecf10436d1a5b28518b4475a70.zip | |
service: Added permissions for auth. indicators read/modify
Added permissions for Kerberos authentication indicators reading and
modifying to service objects.
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
| -rw-r--r-- | ACI.txt | 4 | ||||
| -rw-r--r-- | ipaserver/plugins/service.py | 4 |
2 files changed, 4 insertions, 4 deletions
@@ -249,9 +249,9 @@ aci: (targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objec dn: cn=services,cn=accounts,dc=ipa,dc=example aci: (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=services,cn=accounts,dc=ipa,dc=example -aci: (targetattr = "usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=ipa,dc=example";) +aci: (targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=services,cn=accounts,dc=ipa,dc=example -aci: (targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";) +aci: (targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";) dn: cn=services,cn=accounts,dc=ipa,dc=example aci: (targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=s4u2proxy,cn=etc,dc=ipa,dc=example diff --git a/ipaserver/plugins/service.py b/ipaserver/plugins/service.py index bead94d3f..c44ad7ac2 100644 --- a/ipaserver/plugins/service.py +++ b/ipaserver/plugins/service.py @@ -410,7 +410,7 @@ class service(LDAPObject): 'krbprincipalname', 'krbcanonicalname', 'krbprincipalaliases', 'krbprincipalexpiration', 'krbpasswordexpiration', 'krblastpwdchange', 'ipakrbauthzdata', 'ipakrbprincipalalias', - 'krbobjectreferences', + 'krbobjectreferences', 'krbprincipalauthind', }, }, 'System: Add Services': { @@ -438,7 +438,7 @@ class service(LDAPObject): }, 'System: Modify Services': { 'ipapermright': {'write'}, - 'ipapermdefaultattr': {'usercertificate'}, + 'ipapermdefaultattr': {'usercertificate', 'krbprincipalauthind'}, 'replaces': [ '(targetattr = "usercertificate")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Services";allow (write) groupdn = "ldap:///cn=Modify Services,cn=permissions,cn=pbac,$SUFFIX";)', ], |