On 07/10/2012 07:40 AM, Endi Sukma Dewata wrote:
On 7/9/2012 6:55 AM, Petr Vobornik wrote:
Patch functionality depends on not yet posted pviktori's patch which
adds error_code (in case of command error) to batch response.

Patch description:

This patch adds support for new per-domain permissions to Web UI.

User with assigned permission (through role,priviledge) can edit DNS
zone. These permissions can be added/remove by ipa
dnszone-{add/remove}permission $dnszone command.

For adding/removing of this permission in Web UI new actions in DNS zone
action list were created. DNS zone object doesn't contain information
about existance of related permission. Such information is required for
enabling/disabling of new actions. Web UI has to search for the
permission to get it. DNS zone facet was modified to use batch command,
in a same way as user facet, for loading dnszone and the permission at
the same time - on load.

Batch command has a feature to report all errors. Such behavior is
unwanted because we expect that permission-show command will fail when
the permission doesn't exist. Batch command was therefore modified to
not report commands which has retry attribute set to false. This attr
was chosen because it has similar purpose in single command execution.

New actions should be enabled only for users with appropriate rights. It
is not possible to obtain rights for certain action in advance so an
approximation is used: write right for dns zones' managedby attribute.

https://fedorahosted.org/freeipa/ticket/2851

ACK.

Pushed to master. (dependency was pushed)


The code works, feel free to push when the other patch is ready. But if
time allows it might be better to use a checkbox or radio buttons inside
the details page. That way you can see whether the per-domain permission
is enabled without having to click the drop-down list and infer from the
enabled/disabled actions.


Yes we might want to display the state but I would probably just show it as text, maybe with icon - no interactive control. We should also add something similar to user, sudo rules... (you have pointed out this before).





--
Petr Vobornik


_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel

Reply via email to