Read access to both rules and definitions is given to a new privilege,
'Automember Readers', as well as the existing 'Automember Task
Administrator'.
--
Petr³
From d5d9ca67a3ac3219807efddad4670c71d54f5501 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <[email protected]>
Date: Wed, 26 Mar 2014 17:11:23 +0100
Subject: [PATCH] Add managed read permissions to automember
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
---
install/updates/40-delegation.update | 7 +++++++
ipalib/plugins/automember.py | 29 +++++++++++++++++++++++++++++
2 files changed, 36 insertions(+)
diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update
index 27e605789ba152ac61796217ca12a603958931c1..d69ade6b347130a40779e1b2159a42761381da8e 100644
--- a/install/updates/40-delegation.update
+++ b/install/updates/40-delegation.update
@@ -408,3 +408,10 @@ dn: cn=Password Policy Readers,cn=privileges,cn=pbac,$SUFFIX
default:objectClass: top
default:cn: Password Policy Readers
default:description: Read password policies
+
+dn: cn=Automember Readers,cn=privileges,cn=pbac,$SUFFIX
+default:objectClass: nestedgroup
+default:objectClass: groupofnames
+default:objectClass: top
+default:cn: Automember Readers
+default:description: Read Automember definitions
diff --git a/ipalib/plugins/automember.py b/ipalib/plugins/automember.py
index 4b3f6f06f80ca8d20245a784ac2ba9a07c17a3e9..dad35d45850e56e90ea5f6a30769badec6941119 100644
--- a/ipalib/plugins/automember.py
+++ b/ipalib/plugins/automember.py
@@ -183,10 +183,39 @@ class automember(LDAPObject):
object_name = 'Automember rule'
object_name_plural = 'Automember rules'
object_class = ['top', 'automemberregexrule']
+ permission_filter_objectclasses = ['automemberregexrule']
default_attributes = [
'automemberinclusiveregex', 'automemberexclusiveregex',
'cn', 'automembertargetgroup', 'description', 'automemberdefaultgroup'
]
+ managed_permissions = {
+ 'System: Read Automember Definitions': {
+ 'non_object': True,
+ 'ipapermlocation': DN(container_dn, api.env.basedn),
+ 'ipapermtargetfilter': {'(objectclass=automemberdefinition)'},
+ 'replaces_global_anonymous_aci': True,
+ 'ipapermbindruletype': 'permission',
+ 'ipapermright': {'read', 'search', 'compare'},
+ 'ipapermdefaultattr': {
+ 'objectclass', 'cn', 'automemberscope', 'automemberfilter',
+ 'automembergroupingattr', 'automemberdefaultgroup',
+ 'automemberdisabled',
+ },
+ 'default_privileges': {'Automember Readers',
+ 'Automember Task Administrator'},
+ },
+ 'System: Read Automember Rules': {
+ 'replaces_global_anonymous_aci': True,
+ 'ipapermbindruletype': 'permission',
+ 'ipapermright': {'read', 'search', 'compare'},
+ 'ipapermdefaultattr': {
+ 'cn', 'objectclass', 'automembertargetgroup', 'description',
+ 'automemberexclusiveregex', 'automemberinclusiveregex',
+ },
+ 'default_privileges': {'Automember Readers',
+ 'Automember Task Administrator'},
+ },
+ }
label = _('Auto Membership Rule')
--
1.9.0
_______________________________________________
Freeipa-devel mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/freeipa-devel
