pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0062-add-permission-System-Manage-User-Certificates.patch

590d18
From 159fe81f0f45f83f90037ba3315a3558d0ab94cf Mon Sep 17 00:00:00 2001
590d18
From: Petr Vobornik <pvoborni@redhat.com>
590d18
Date: Wed, 12 Aug 2015 14:48:09 +0200
590d18
Subject: [PATCH] add permission: System: Manage User Certificates
590d18
590d18
usercertificate attr was moved from "System Modify Users" to this
590d18
new permission.
590d18
590d18
https://fedorahosted.org/freeipa/ticket/5177
590d18
590d18
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
590d18
---
590d18
 ACI.txt                |  4 +++-
590d18
 ipalib/plugins/user.py | 10 +++++++++-
590d18
 2 files changed, 12 insertions(+), 2 deletions(-)
590d18
590d18
diff --git a/ACI.txt b/ACI.txt
590d18
index 60607b98deb74d0b7f45d24ee9359b0cf8162b0d..99099275e1383f16aca122e05e34b2330f4d06a3 100644
590d18
--- a/ACI.txt
590d18
+++ b/ACI.txt
590d18
@@ -309,9 +309,11 @@ aci: (targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:S
590d18
 dn: cn=users,cn=accounts,dc=ipa,dc=example
590d18
 aci: (targetattr = "krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=ipa,dc=example))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Change User password";allow (write) groupdn = "ldap:///cn=System: Change User password,cn=permissions,cn=pbac,dc=ipa,dc=example";)
590d18
 dn: cn=users,cn=accounts,dc=ipa,dc=example
590d18
+aci: (targetattr = "usercertificate")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Manage User Certificates";allow (write) groupdn = "ldap:///cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=ipa,dc=example";)
590d18
+dn: cn=users,cn=accounts,dc=ipa,dc=example
590d18
 aci: (targetattr = "ipasshpubkey")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Manage User SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage User SSH Public Keys,cn=permissions,cn=pbac,dc=ipa,dc=example";)
590d18
 dn: cn=users,cn=accounts,dc=ipa,dc=example
590d18
-aci: (targetattr = "businesscategory || carlicense || cn || description || displayname || employeetype || facsimiletelephonenumber || gecos || givenname || homephone || inetuserhttpurl || initials || l || labeleduri || loginshell || manager || mepmanagedentry || mobile || objectclass || ou || pager || postalcode || preferredlanguage || roomnumber || secretary || seealso || sn || st || street || telephonenumber || title || usercertificate || userclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify Users";allow (write) groupdn = "ldap:///cn=System: Modify Users,cn=permissions,cn=pbac,dc=ipa,dc=example";)
590d18
+aci: (targetattr = "businesscategory || carlicense || cn || description || displayname || employeetype || facsimiletelephonenumber || gecos || givenname || homephone || inetuserhttpurl || initials || l || labeleduri || loginshell || manager || mepmanagedentry || mobile || objectclass || ou || pager || postalcode || preferredlanguage || roomnumber || secretary || seealso || sn || st || street || telephonenumber || title || userclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify Users";allow (write) groupdn = "ldap:///cn=System: Modify Users,cn=permissions,cn=pbac,dc=ipa,dc=example";)
590d18
 dn: cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,dc=ipa,dc=example
590d18
 aci: (targetattr = "*")(target = "ldap:///cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,dc=ipa,dc=example")(version 3.0;acl "permission:System: Read UPG Definition";allow (compare,read,search) groupdn = "ldap:///cn=System: Read UPG Definition,cn=permissions,cn=pbac,dc=ipa,dc=example";)
590d18
 dn: cn=users,cn=accounts,dc=ipa,dc=example
590d18
diff --git a/ipalib/plugins/user.py b/ipalib/plugins/user.py
590d18
index 4ea770ede7525149780f1486b5e4eb44699c8533..90ae7260abf935abf92b49da04c11bc76e836e49 100644
590d18
--- a/ipalib/plugins/user.py
590d18
+++ b/ipalib/plugins/user.py
590d18
@@ -259,6 +259,14 @@ class user(baseuser):
590d18
             ],
590d18
             'default_privileges': {'User Administrators'},
590d18
         },
590d18
+        'System: Manage User Certificates': {
590d18
+            'ipapermright': {'write'},
590d18
+            'ipapermdefaultattr': {'usercertificate'},
590d18
+            'default_privileges': {
590d18
+                'User Administrators',
590d18
+                'Modify Users and Reset passwords',
590d18
+            },
590d18
+        },
590d18
         'System: Modify Users': {
590d18
             'ipapermright': {'write'},
590d18
             'ipapermdefaultattr': {
590d18
@@ -269,7 +277,7 @@ class user(baseuser):
590d18
                 'mepmanagedentry', 'mobile', 'objectclass', 'ou', 'pager',
590d18
                 'postalcode', 'roomnumber', 'secretary', 'seealso', 'sn', 'st',
590d18
                 'street', 'telephonenumber', 'title', 'userclass',
590d18
-                'preferredlanguage', 'usercertificate',
590d18
+                'preferredlanguage',
590d18
             },
590d18
             'replaces': [
590d18
                 '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou || mepmanagedentry || objectclass")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Users";allow (write) groupdn = "ldap:///cn=Modify Users,cn=permissions,cn=pbac,$SUFFIX";)',
590d18
-- 
590d18
2.4.3
590d18