Convert Service default permissions to managed

Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>

3 files changed, 38 insertions, 55 deletions

diff --git a/ACI.txt b/ACI.txt
index 181296e37..efdbcfd3d 100644
--- a/ACI.txt
+++ b/ACI.txt
@@ -164,8 +164,16 @@ dn: cn=System: Read SELinux User Maps,cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetattr = "accesstime || cn || description || hostcategory || ipaenabledflag || ipaselinuxuser || ipauniqueid || member || memberhost || memberuser || objectclass || seealso || usercategory")(targetfilter = "(objectclass=ipaselinuxusermap)")(version 3.0;acl "permission:System: Read SELinux User Maps";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=System: Remove SELinux User Maps,cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=ipaselinuxusermap)")(version 3.0;acl "permission:System: Remove SELinux User Maps";allow (delete) groupdn = "ldap:///cn=System: Remove SELinux User Maps,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=System: Add Services,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Add Services";allow (add) groupdn = "ldap:///cn=System: Add Services,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=System: Modify Services,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetattr = "usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=System: Read Services,cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetattr = "ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalexpiration || krbprincipalname || managedby || memberof || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";)
+dn: cn=System: Remove Services,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=System: Read Sudo Commands,cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetattr = "description || ipauniqueid || memberof || objectclass || sudocmd")(targetfilter = "(objectclass=ipasudocmd)")(version 3.0;acl "permission:System: Read Sudo Commands";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=System: Read Sudo Command Groups,cn=permissions,cn=pbac,dc=ipa,dc=example
diff --git a/install/share/delegation.ldif b/install/share/delegation.ldif
index d355568c6..66a9f1b07 100644
--- a/install/share/delegation.ldif
+++ b/install/share/delegation.ldif
@@ -133,41 +133,6 @@ description: Host Enrollment
 # Default permissions.
 ############################################
 
-# Service administration
-
-dn: cn=Add Services,cn=permissions,cn=pbac,$SUFFIX
-changetype: add
-objectClass: top
-objectClass: groupofnames
-objectClass: ipapermission
-cn: Add Services
-member: cn=Service Administrators,cn=privileges,cn=pbac,$SUFFIX
-
-dn: cn=Remove Services,cn=permissions,cn=pbac,$SUFFIX
-changetype: add
-objectClass: top
-objectClass: groupofnames
-objectClass: ipapermission
-cn: Remove Services
-member: cn=Service Administrators,cn=privileges,cn=pbac,$SUFFIX
-
-dn: cn=Modify Services,cn=permissions,cn=pbac,$SUFFIX
-changetype: add
-objectClass: top
-objectClass: groupofnames
-objectClass: ipapermission
-cn: Modify Services
-member: cn=Service Administrators,cn=privileges,cn=pbac,$SUFFIX
-
-dn: cn=Manage service keytab,cn=permissions,cn=pbac,$SUFFIX
-changetype: add
-objectClass: top
-objectClass: groupofnames
-objectClass: ipapermission
-cn: Manage service keytab
-member: cn=Service Administrators,cn=privileges,cn=pbac,$SUFFIX
-member: cn=admins,cn=groups,cn=accounts,$SUFFIX
-
 # DNS administration
 
 # The permission and aci for this is in install/updates/dns.ldif
@@ -210,26 +175,6 @@ cn: Modify DNA Range
 ipapermissiontype: SYSTEM
 member: cn=Replication Administrators,cn=privileges,cn=pbac,$SUFFIX
 
-############################################
-# Default permissions (ACIs)
-############################################
-
-# Service administration
-
-dn: $SUFFIX
-changetype: modify
-add: aci
-aci: (target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Add Services";allow (add) groupdn = "ldap:///cn=Add Services,cn=permissions,cn=pbac,$SUFFIX";)
-aci: (target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Remove Services";allow (delete) groupdn = "ldap:///cn=Remove Services,cn=permissions,cn=pbac,$SUFFIX";)
-aci: (targetattr = "usercertificate")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Services";allow (write) groupdn = "ldap:///cn=Modify Services,cn=permissions,cn=pbac,$SUFFIX";)
-
-# Service keytab admin
-
-dn: $SUFFIX
-changetype: modify
-add: aci
-aci: (targetattr = "krbprincipalkey || krblastpwdchange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage service keytab";allow (write) groupdn = "ldap:///cn=Manage service keytab,cn=permissions,cn=pbac,$SUFFIX";)
-
 # Create virtual operations entry. This is used to control access to
 # operations that don't rely on LDAP directly.
 dn: cn=virtual operations,cn=etc,$SUFFIX
diff --git a/ipalib/plugins/service.py b/ipalib/plugins/service.py
index 0572a0ae2..8d6a14711 100644
--- a/ipalib/plugins/service.py
+++ b/ipalib/plugins/service.py
@@ -330,6 +330,36 @@ class service(LDAPObject):
                 'krbobjectreferences',
             },
         },
+        'System: Add Services': {
+            'ipapermright': {'add'},
+            'replaces': [
+                '(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Add Services";allow (add) groupdn = "ldap:///cn=Add Services,cn=permissions,cn=pbac,$SUFFIX";)',
+            ],
+            'default_privileges': {'Service Administrators'},
+        },
+        'System: Manage Service Keytab': {
+            'ipapermright': {'write'},
+            'ipapermdefaultattr': {'krblastpwdchange', 'krbprincipalkey'},
+            'replaces': [
+                '(targetattr = "krbprincipalkey || krblastpwdchange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage service keytab";allow (write) groupdn = "ldap:///cn=Manage service keytab,cn=permissions,cn=pbac,$SUFFIX";)',
+            ],
+            'default_privileges': {'Service Administrators'},
+        },
+        'System: Modify Services': {
+            'ipapermright': {'write'},
+            'ipapermdefaultattr': {'usercertificate'},
+            'replaces': [
+                '(targetattr = "usercertificate")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Services";allow (write) groupdn = "ldap:///cn=Modify Services,cn=permissions,cn=pbac,$SUFFIX";)',
+            ],
+            'default_privileges': {'Service Administrators'},
+        },
+        'System: Remove Services': {
+            'ipapermright': {'delete'},
+            'replaces': [
+                '(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Remove Services";allow (delete) groupdn = "ldap:///cn=Remove Services,cn=permissions,cn=pbac,$SUFFIX";)',
+            ],
+            'default_privileges': {'Service Administrators'},
+        },
     }
 
     label = _('Services')