Hi, this is a follow up patch for 232. Read access to additional attributes is required for the trust objects.
-- Tomas Babej Associate Software Engineer | Red Hat | Identity Management RHCE | Brno Site | IRC: tbabej | freeipa.org
>From 8a0849d4bf59b61715ba7b055e980cc38a9fcd6a Mon Sep 17 00:00:00 2001 From: Tomas Babej <[email protected]> Date: Tue, 24 Jun 2014 13:58:28 +0200 Subject: [PATCH] trusts: Add more read attributes --- ACI.txt | 2 +- ipalib/plugins/trust.py | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/ACI.txt b/ACI.txt index 11af74a3d7155e92debe089dc15c7306ad120258..0398a52fcf2639f895f6bb7cd8bd91412affa6d3 100644 --- a/ACI.txt +++ b/ACI.txt @@ -111,7 +111,7 @@ aci: (targetattr = "cmdcategory || cn || description || externalhost || external dn: cn=System: Read Sudoers compat tree,cn=permissions,cn=pbac,dc=ipa,dc=example aci: (targetattr = "cn || description || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=ipa,dc=example";)(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///all";;) dn: cn=System: Read Trust Information,cn=permissions,cn=pbac,dc=ipa,dc=example -aci: (targetattr = "cn || ipantflatname || ipantsecurityidentifier || ipanttrusteddomainsid || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";;) +aci: (targetattr = "cn || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrusteddomainsid || ipanttrustpartner || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";;) dn: cn=System: Add User to default group,cn=permissions,cn=pbac,dc=ipa,dc=example aci: (targetattr = "member")(target = "ldap:///cn=ipausers,cn=groups,cn=accounts,dc=ipa,dc=example";)(version 3.0;acl "permission:System: Add User to default group";allow (write) groupdn = "ldap:///cn=System: Add User to default group,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=System: Add Users,cn=permissions,cn=pbac,dc=ipa,dc=example diff --git a/ipalib/plugins/trust.py b/ipalib/plugins/trust.py index 987fb7476d62b7aba5ef304d01a6d5922235d5b1..25755d7a41e93b869f4d4afbf0ac094c42212451 100644 --- a/ipalib/plugins/trust.py +++ b/ipalib/plugins/trust.py @@ -326,7 +326,8 @@ class trust(LDAPObject): 'ipapermdefaultattr': { 'cn', 'objectclass', 'ipantflatname', 'ipantsecurityidentifier', - 'ipanttrusteddomainsid', + 'ipanttrusteddomainsid', 'ipanttrustpartner', + 'ipantsidblacklistincoming', 'ipantsidblacklistoutgoing' }, }, } -- 1.9.3
_______________________________________________ Freeipa-devel mailing list [email protected] https://www.redhat.com/mailman/listinfo/freeipa-devel
