diff options
| author | Petr Viktorin <pviktori@redhat.com> | 2014-03-26 17:11:23 +0100 |
|---|---|---|
| committer | Petr Viktorin <pviktori@redhat.com> | 2014-04-28 16:17:38 +0200 |
| commit | 7eb12f1fb51e94ad851721c167461d75366dfeb9 (patch) | |
| tree | e70c2adad0f8d3bd1f55cffd583a3994aaf9d1da | |
| parent | e31688909cbc5f7ab6c8d03bb28786a2dd29efe4 (diff) | |
| download | freeipa-7eb12f1fb51e94ad851721c167461d75366dfeb9.tar.gz freeipa-7eb12f1fb51e94ad851721c167461d75366dfeb9.tar.xz freeipa-7eb12f1fb51e94ad851721c167461d75366dfeb9.zip | |
Add managed read permissions to trust
A single permission is added to cover trust, trustconfig, and trustdomain.
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
Reviewed-By: Martin Kosek <mkosek@redhat.com>
| -rw-r--r-- | ipalib/plugins/trust.py | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/ipalib/plugins/trust.py b/ipalib/plugins/trust.py index 2e6af1687..bff44053f 100644 --- a/ipalib/plugins/trust.py +++ b/ipalib/plugins/trust.py @@ -311,6 +311,21 @@ class trust(LDAPObject): 'ipanttrustposixoffset', 'ipantsupportedencryptiontypes' ] search_display_attributes = ['cn', 'ipantflatname', 'ipanttrusteddomainsid', 'ipanttrusttype'] + managed_permissions = { + 'System: Read Trust Information': { + # Allow reading of attributes needed for SSSD subdomains support + 'non_object': True, + 'ipapermlocation': DN(container_dn, api.env.basedn), + 'replaces_global_anonymous_aci': True, + 'ipapermbindruletype': 'all', + 'ipapermright': {'read', 'search', 'compare'}, + 'ipapermdefaultattr': { + 'cn', 'objectclass', + 'ipantflatname', 'ipantsecurityidentifier', + 'ipanttrusteddomainsid', + }, + }, + } label = _('Trusts') label_singular = _('Trust') |