freeipa.git/ipalib/plugins/privilege.py, branch webui_isolate

ipalib: move server-side plugins to ipaserver

2016-06-03T07:00:34+00:00

Move the remaining plugin code from ipalib.plugins to ipaserver.plugins.

Remove the now unused ipalib.plugins package.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka

ipalib: use relative imports for cross-plugin imports

2016-05-25T14:06:26+00:00

This will make it possible to move the plugin modules between ipalib,
ipaclient and ipaserver without having to change the imports.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka

Remove wildcard imports

2015-12-23T06:59:22+00:00

Wildcard imports should not be used.

Check for wildcard imports has been enabled in pylint.
Pylint note: options 'wildcard-import' causes too much false positive
results, so instead it I used 'unused-wildcard-import' option which has almost
the same effect.

Reviewed-By: Jan Cholasta

Validate adding privilege to a permission

2015-07-17T04:57:54+00:00

Adding priviledge to a permission via webUI allowed to avoid check and to add permission
with improper type.

https://fedorahosted.org/freeipa/ticket/5075

Reviewed-By: Jan Cholasta

Do not require description in UI.

2014-09-29T10:53:43+00:00

Description attribute is not required in LDAP schema so there is no reason to
require it in UI. Modified tests to reflect this change.

https://fedorahosted.org/freeipa/ticket/4387

Reviewed-By: Martin Kosek

Add several CRUD default permissions

2014-06-24T11:53:41+00:00

Add missing Add, Modify, Removedefault permissions to:
- automountlocation (Add/Remove only; locations have
   no data to modify)
- privilege
- sudocmdgroup (Modify only; the others were present)

Related to: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek

Make sure member* attrs are always granted together in read permissions

2014-06-11T11:21:30+00:00

Memberofindirect processing of an entry doesn't work if the user doesn't
have rights to any one of these attributes:
- member
- memberuser
- memberhost

Add all of these to any read permission that specifies any of them.

Add a check to makeaci that will enforce this for any future permissions.

Reviewed-By: Martin Kosek

Make 'permission' the default bind type for managed permissions

2014-06-11T11:21:29+00:00

This reduces typing (or copy/pasting), and draws a bit of attention
to any non-default privileges (currently 'any' or 'anonymous').

Leaving the bindtype out by mistake isn't dangerous: by default
a permission is not granted to anyone, since it is not included in
any priviliges.

Reviewed-By: Martin Kosek

Add managed read permissions to RBAC objects

2014-04-11T08:17:41+00:00

Add default read permissions to roles, privileges and permissions.
Also add permission to read ACIs. This is required for legacy permissions.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Allow anonymous and all permissions

2014-01-07T08:56:41+00:00

Disallow adding permissions with non-default bindtype to privileges

Ticket: https://fedorahosted.org/freeipa/ticket/4032
Design: http://www.freeipa.org/page/V3/Anonymous_and_All_permissions