On Mon, 2014-02-10 at 15:11 +0200, Alexander Bokovoy wrote: > On Thu, 06 Feb 2014, Nathaniel McCallum wrote: > >On Thu, 2014-01-09 at 16:32 -0500, Nathaniel McCallum wrote: > >> This patch is independent from my patches 0028-0031 and can be merged in > >> any order. > >> > >> This patch has a bug, but I can't figure it out. We need to set > >> nsslapd-access-userattr-strict on cn=config to "off". However, during > >> the rpm installation, I get this error: > >> > >> DEBUG Unhandled LDAPError: UNWILLING_TO_PERFORM: {'info': 'Deleting > >> attributes is not allowed', 'desc': 'Server is unwilling to perform'} > >> ERROR Update failed: Server is unwilling to perform: Deleting attributes > >> is not allowed > >> > >> I'm not sure what is causing this. Does anyone have any suggestions? > > > >Attached is a new revision of this patch. It uses the new SELFDN support > >present in 389-ds-base 1.3.2.11 that was a result of the previous review > >of this patch. > > > >It currently depends on the HOTP patch (0033-2). However, if we wish to > >merge this first, this could be easily rebased. > Could you please rebase it? It would be good to merge it first because > 0033-2 depends on otp infrastructure patches.
Done. Nathaniel
>From 3b97eec3a17fec3883520a1cee35fdfa3d529cc9 Mon Sep 17 00:00:00 2001 From: Nathaniel McCallum <npmccal...@redhat.com> Date: Thu, 6 Feb 2014 11:27:29 -0500 Subject: [PATCH] Update ACIs to permit users to add/delete their own tokens --- freeipa.spec.in | 6 +++--- install/share/default-aci.ldif | 1 + install/updates/40-otp.update | 1 + 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/freeipa.spec.in b/freeipa.spec.in index c28928c1c5c2d20e2dfe6112750c70bfb0b55894..486cd6156be62d4656c181c8739fc5f7e24711cd 100644 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -21,7 +21,7 @@ Source0: freeipa-%{version}.tar.gz BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) %if ! %{ONLY_CLIENT} -BuildRequires: 389-ds-base-devel >= 1.3.2.10 +BuildRequires: 389-ds-base-devel >= 1.3.2.11 BuildRequires: svrcore-devel BuildRequires: policycoreutils >= %{POLICYCOREUTILSVER} BuildRequires: systemd-units @@ -97,7 +97,7 @@ Group: System Environment/Base Requires: %{name}-python = %{version}-%{release} Requires: %{name}-client = %{version}-%{release} Requires: %{name}-admintools = %{version}-%{release} -Requires: 389-ds-base >= 1.3.2.10 +Requires: 389-ds-base >= 1.3.2.11 Requires: openldap-clients > 2.4.35-4 %if 0%{?fedora} == 18 Requires: nss >= 3.14.3-2 @@ -153,7 +153,7 @@ Requires: zip Requires: policycoreutils >= %{POLICYCOREUTILSVER} Requires: tar Requires(pre): certmonger >= 0.65 -Requires(pre): 389-ds-base >= 1.3.2.10 +Requires(pre): 389-ds-base >= 1.3.2.11 Requires: fontawesome-fonts Requires: open-sans-fonts diff --git a/install/share/default-aci.ldif b/install/share/default-aci.ldif index 9af9ab28c72e35f7912795e5280170cc6e1bdd80..b7df72109aacdb5cfba9f190da2935917eccaeaa 100644 --- a/install/share/default-aci.ldif +++ b/install/share/default-aci.ldif @@ -103,3 +103,4 @@ add: aci aci: (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || ipatokenUniqueID || description || ipatokenOwner || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Users can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN";) aci: (targetfilter = "(objectClass=ipaToken)")(targetattrs = "ipatokenUniqueID || description || ipatokenOwner || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Users can write basic token info"; allow (write) userattr = "ipatokenOwner#USERDN";) aci: (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPkey || ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPclockOffset || ipatokenTOTPtimeStep")(version 3.0; acl "Users can add TOTP token secrets"; allow (write, search) userattr = "ipatokenOwner#USERDN";) +aci: (target = "ldap:///ipatokenuniqueid=*,cn=otp,$SUFFIX")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create and delete tokens"; allow (add, delete) userattr = "ipatokenOwner#SELFDN";) diff --git a/install/updates/40-otp.update b/install/updates/40-otp.update index 83dfab7c03bfeb121756410d79143c3812146de6..8e1300fb3d38970e106ac03dce4ce3cb776cd7d1 100644 --- a/install/updates/40-otp.update +++ b/install/updates/40-otp.update @@ -7,6 +7,7 @@ dn: $SUFFIX add: aci:'(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || ipatokenUniqueID || description || ipatokenOwner || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Users can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN";)' add: aci:'(targetfilter = "(objectClass=ipaToken)")(targetattrs = "ipatokenUniqueID || description || ipatokenOwner || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Users can write basic token info"; allow (write) userattr = "ipatokenOwner#USERDN";)' add: aci:'(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPkey || ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPclockOffset || ipatokenTOTPtimeStep")(version 3.0; acl "Users can add TOTP token secrets"; allow (write, search) userattr = "ipatokenOwner#USERDN";)' +add: aci:'(target = "ldap:///ipatokenuniqueid=*,cn=otp,$SUFFIX")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create and delete tokens"; allow (add, delete) userattr = "ipatokenOwner#SELFDN";)' dn: cn=radiusproxy,$SUFFIX default: objectClass: nsContainer -- 1.8.5.3
_______________________________________________ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel