Read access to both rules and definitions is given to a new privilege, 'Automember Readers', as well as the existing 'Automember Task Administrator'.


--
PetrĀ³
From d5d9ca67a3ac3219807efddad4670c71d54f5501 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pvikt...@redhat.com>
Date: Wed, 26 Mar 2014 17:11:23 +0100
Subject: [PATCH] Add managed read permissions to automember

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
---
 install/updates/40-delegation.update |  7 +++++++
 ipalib/plugins/automember.py         | 29 +++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update
index 27e605789ba152ac61796217ca12a603958931c1..d69ade6b347130a40779e1b2159a42761381da8e 100644
--- a/install/updates/40-delegation.update
+++ b/install/updates/40-delegation.update
@@ -408,3 +408,10 @@ dn: cn=Password Policy Readers,cn=privileges,cn=pbac,$SUFFIX
 default:objectClass: top
 default:cn: Password Policy Readers
 default:description: Read password policies
+
+dn: cn=Automember Readers,cn=privileges,cn=pbac,$SUFFIX
+default:objectClass: nestedgroup
+default:objectClass: groupofnames
+default:objectClass: top
+default:cn: Automember Readers
+default:description: Read Automember definitions
diff --git a/ipalib/plugins/automember.py b/ipalib/plugins/automember.py
index 4b3f6f06f80ca8d20245a784ac2ba9a07c17a3e9..dad35d45850e56e90ea5f6a30769badec6941119 100644
--- a/ipalib/plugins/automember.py
+++ b/ipalib/plugins/automember.py
@@ -183,10 +183,39 @@ class automember(LDAPObject):
     object_name = 'Automember rule'
     object_name_plural = 'Automember rules'
     object_class = ['top', 'automemberregexrule']
+    permission_filter_objectclasses = ['automemberregexrule']
     default_attributes = [
         'automemberinclusiveregex', 'automemberexclusiveregex',
         'cn', 'automembertargetgroup', 'description', 'automemberdefaultgroup'
     ]
+    managed_permissions = {
+        'System: Read Automember Definitions': {
+            'non_object': True,
+            'ipapermlocation': DN(container_dn, api.env.basedn),
+            'ipapermtargetfilter': {'(objectclass=automemberdefinition)'},
+            'replaces_global_anonymous_aci': True,
+            'ipapermbindruletype': 'permission',
+            'ipapermright': {'read', 'search', 'compare'},
+            'ipapermdefaultattr': {
+                'objectclass', 'cn', 'automemberscope', 'automemberfilter',
+                'automembergroupingattr', 'automemberdefaultgroup',
+                'automemberdisabled',
+            },
+            'default_privileges': {'Automember Readers',
+                                   'Automember Task Administrator'},
+        },
+        'System: Read Automember Rules': {
+            'replaces_global_anonymous_aci': True,
+            'ipapermbindruletype': 'permission',
+            'ipapermright': {'read', 'search', 'compare'},
+            'ipapermdefaultattr': {
+                'cn', 'objectclass', 'automembertargetgroup', 'description',
+                'automemberexclusiveregex', 'automemberinclusiveregex',
+            },
+            'default_privileges': {'Automember Readers',
+                                   'Automember Task Administrator'},
+        },
+    }
 
     label = _('Auto Membership Rule')
 
-- 
1.9.0

_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel

Reply via email to