freeipa.git/ipalib/plugins/role.py, branch webui_isolate

ipalib: move server-side plugins to ipaserver

2016-06-03T07:00:34+00:00

Move the remaining plugin code from ipalib.plugins to ipaserver.plugins.

Remove the now unused ipalib.plugins package.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka

ipalib: use relative imports for cross-plugin imports

2016-05-25T14:06:26+00:00

This will make it possible to move the plugin modules between ipalib,
ipaclient and ipaserver without having to change the imports.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka

Remove wildcard imports

2015-12-23T06:59:22+00:00

Wildcard imports should not be used.

Check for wildcard imports has been enabled in pylint.
Pylint note: options 'wildcard-import' causes too much false positive
results, so instead it I used 'unused-wildcard-import' option which has almost
the same effect.

Reviewed-By: Jan Cholasta

Remove unused imports

2015-12-23T06:59:22+00:00

This patch removes unused imports, alse pylint has been configured to
check unused imports.

Reviewed-By: Jan Cholasta

speed up indirect member processing

2015-04-27T05:55:04+00:00

the old implementation tried to get all entries which are member of group.
That means also user. User can't have any members therefore this costly
processing was unnecessary.

New implementation reduces the search only to entries which have members.

Also page size was removed to avoid paging by small pages(default size: 100)
which is very slow for many members.

https://fedorahosted.org/freeipa/ticket/4947

Reviewed-By: Jan Cholasta

Do not require description in UI.

2014-09-29T10:53:43+00:00

Description attribute is not required in LDAP schema so there is no reason to
require it in UI. Modified tests to reflect this change.

https://fedorahosted.org/freeipa/ticket/4387

Reviewed-By: Martin Kosek

Support delegating RBAC roles to service principals

2014-08-21T12:07:01+00:00

https://fedorahosted.org/freeipa/ticket/3164

Reviewed-By: Martin Kosek

Convert Role default permissions to managed

2014-06-24T11:53:40+00:00

Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek

Make sure member* attrs are always granted together in read permissions

2014-06-11T11:21:30+00:00

Memberofindirect processing of an entry doesn't work if the user doesn't
have rights to any one of these attributes:
- member
- memberuser
- memberhost

Add all of these to any read permission that specifies any of them.

Add a check to makeaci that will enforce this for any future permissions.

Reviewed-By: Martin Kosek

Make 'permission' the default bind type for managed permissions

2014-06-11T11:21:29+00:00

This reduces typing (or copy/pasting), and draws a bit of attention
to any non-default privileges (currently 'any' or 'anonymous').

Leaving the bindtype out by mistake isn't dangerous: by default
a permission is not granted to anyone, since it is not included in
any priviliges.

Reviewed-By: Martin Kosek