On Thu, 2014-01-09 at 16:32 -0500, Nathaniel McCallum wrote:
> This patch is independent from my patches 0028-0031 and can be merged in
> any order.
> 
> This patch has a bug, but I can't figure it out. We need to set
> nsslapd-access-userattr-strict on cn=config to "off". However, during
> the rpm installation, I get this error:
> 
> DEBUG Unhandled LDAPError: UNWILLING_TO_PERFORM: {'info': 'Deleting
> attributes is not allowed', 'desc': 'Server is unwilling to perform'}
> ERROR Update failed: Server is unwilling to perform: Deleting attributes
> is not allowed
> 
> I'm not sure what is causing this. Does anyone have any suggestions?

Attached is a new revision of this patch. It uses the new SELFDN support
present in 389-ds-base 1.3.2.11 that was a result of the previous review
of this patch.

It currently depends on the HOTP patch (0033-2). However, if we wish to
merge this first, this could be easily rebased.
>From a235d3949d81d4ddde31e386b4a7fa47df4240a2 Mon Sep 17 00:00:00 2001
From: Nathaniel McCallum <npmccal...@redhat.com>
Date: Thu, 6 Feb 2014 11:27:29 -0500
Subject: [PATCH] Update ACIs to permit users to add/delete their own tokens

---
 freeipa.spec.in                | 6 +++---
 install/share/default-aci.ldif | 1 +
 install/updates/40-otp.update  | 1 +
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/freeipa.spec.in b/freeipa.spec.in
index 628efbfe0a2601557d6e8847798332bf34bc9a79..16378e1313503c2367174304cb7e07a6aee4decd 100644
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -21,7 +21,7 @@ Source0:        freeipa-%{version}.tar.gz
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 %if ! %{ONLY_CLIENT}
-BuildRequires:  389-ds-base-devel >= 1.3.2.10
+BuildRequires:  389-ds-base-devel >= 1.3.2.11
 BuildRequires:  svrcore-devel
 BuildRequires:  policycoreutils >= %{POLICYCOREUTILSVER}
 BuildRequires:  systemd-units
@@ -97,7 +97,7 @@ Group: System Environment/Base
 Requires: %{name}-python = %{version}-%{release}
 Requires: %{name}-client = %{version}-%{release}
 Requires: %{name}-admintools = %{version}-%{release}
-Requires: 389-ds-base >= 1.3.2.10
+Requires: 389-ds-base >= 1.3.2.11
 Requires: openldap-clients > 2.4.35-4
 %if 0%{?fedora} == 18
 Requires: nss >= 3.14.3-2
@@ -153,7 +153,7 @@ Requires: zip
 Requires: policycoreutils >= %{POLICYCOREUTILSVER}
 Requires: tar
 Requires(pre): certmonger >= 0.65
-Requires(pre): 389-ds-base >= 1.3.2.10
+Requires(pre): 389-ds-base >= 1.3.2.11
 Requires: fontawesome-fonts
 Requires: open-sans-fonts
 
diff --git a/install/share/default-aci.ldif b/install/share/default-aci.ldif
index 76dd93f4ef2ca5ff6974e6c7ce53f5b7149e55d9..b1c2cbc109dc910cc38c4219a094ffac02a12a57 100644
--- a/install/share/default-aci.ldif
+++ b/install/share/default-aci.ldif
@@ -104,3 +104,4 @@ aci: (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || ipa
 aci: (targetfilter = "(objectClass=ipaToken)")(targetattrs = "ipatokenUniqueID || description || ipatokenOwner || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Users can write basic token info"; allow (write) userattr = "ipatokenOwner#USERDN";)
 aci: (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPkey || ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPclockOffset || ipatokenTOTPtimeStep")(version 3.0; acl "Users can add TOTP token secrets"; allow (write, search) userattr = "ipatokenOwner#USERDN";)
 aci: (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPkey || ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenHOTPcounter")(version 3.0; acl "Users can add HOTP token secrets"; allow (write, search) userattr = "ipatokenOwner#USERDN";)
+aci: (target = "ldap:///ipatokenuniqueid=*,cn=otp,$SUFFIX";)(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create and delete tokens"; allow (add, delete) userattr = "ipatokenOwner#SELFDN";)
diff --git a/install/updates/40-otp.update b/install/updates/40-otp.update
index 750d0f8b3134fb4a81f4d35a1743b8c48113a88f..4384c7351f9a7e3eab18aa38b584c7dabcee7cf5 100644
--- a/install/updates/40-otp.update
+++ b/install/updates/40-otp.update
@@ -8,6 +8,7 @@ add: aci:'(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass |
 add: aci:'(targetfilter = "(objectClass=ipaToken)")(targetattrs = "ipatokenUniqueID || description || ipatokenOwner || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Users can write basic token info"; allow (write) userattr = "ipatokenOwner#USERDN";)'
 add: aci:'(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPkey || ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPclockOffset || ipatokenTOTPtimeStep")(version 3.0; acl "Users can add TOTP token secrets"; allow (write, search) userattr = "ipatokenOwner#USERDN";)'
 add: aci:'(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPkey || ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenHOTPcounter")(version 3.0; acl "Users can add HOTP token secrets"; allow (write, search) userattr = "ipatokenOwner#USERDN";)'
+add: aci:'(target = "ldap:///ipatokenuniqueid=*,cn=otp,$SUFFIX";)(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create and delete tokens"; allow (add, delete) userattr = "ipatokenOwner#SELFDN";)'
 
 dn: cn=radiusproxy,$SUFFIX
 default: objectClass: nsContainer
-- 
1.8.5.3

_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel

Reply via email to