From bb4e47d9ea249d7f3ead460284dd67312cc82bd5 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Wed, 26 Mar 2014 16:29:16 +0100 Subject: Add managed read permission to idrange Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek --- ipalib/plugins/idrange.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'ipalib') diff --git a/ipalib/plugins/idrange.py b/ipalib/plugins/idrange.py index 91d8525db..5cc2786ce 100644 --- a/ipalib/plugins/idrange.py +++ b/ipalib/plugins/idrange.py @@ -161,10 +161,23 @@ class idrange(LDAPObject): object_name = ('range') object_name_plural = ('ranges') object_class = ['ipaIDrange'] + permission_filter_objectclasses = ['ipaidrange'] possible_objectclasses = ['ipadomainidrange', 'ipatrustedaddomainrange'] default_attributes = ['cn', 'ipabaseid', 'ipaidrangesize', 'ipabaserid', 'ipasecondarybaserid', 'ipanttrusteddomainsid', 'iparangetype'] + managed_permissions = { + 'System: Read ID Ranges': { + 'replaces_global_anonymous_aci': True, + 'ipapermbindruletype': 'all', + 'ipapermright': {'read', 'search', 'compare'}, + 'ipapermdefaultattr': { + 'cn', 'objectclass', + 'ipabaseid', 'ipaidrangesize', 'iparangetype', + 'ipabaserid', 'ipasecondarybaserid', 'ipanttrusteddomainsid', + }, + }, + } label = _('ID Ranges') label_singular = _('ID Range') -- cgit