On 06/25/2014 11:45 AM, Petr Viktorin wrote:
> On 06/24/2014 08:15 PM, Tomas Babej wrote:
>> Attaching patch 234, which resolves another ACI issue related to trusts.
>>
>> On 06/24/2014 02:50 PM, Tomas Babej wrote:
>>> Hi,
>>>
>>> this is a follow up patch for 232. Read access to additional attributes
>>> is required for the trust objects.
>>>
>
> First patch looks fine.
>
> For the second: should the trust ACIs apply to other objects than
> (objectclas=ipanttrusteddomain)?
> If not, we can enable "--type=trust" permissions and use it to specify
> location & filter, see attached patch.
>
>
Turns out there are also kerberos principals stored under cn=trust tree
and this filter would block the access to them.

Attached is a new version of 234, which allows reading krbPrincipalName
as well.

-- 
Tomas Babej
Associate Software Engineer | Red Hat | Identity Management
RHCE | Brno Site | IRC: tbabej | freeipa.org 

>From 536b386a9196957edccc8731c1c2d9ed204c69e3 Mon Sep 17 00:00:00 2001
From: Tomas Babej <tba...@redhat.com>
Date: Tue, 24 Jun 2014 18:24:32 +0200
Subject: [PATCH] trusts: Allow reading system trust accounts by adtrust agents

---
 ACI.txt                          |  2 ++
 install/updates/60-trusts.update |  8 ++++++++
 ipalib/plugins/trust.py          | 11 +++++++++++
 3 files changed, 21 insertions(+)

diff --git a/ACI.txt b/ACI.txt
index 0398a52fcf2639f895f6bb7cd8bd91412affa6d3..43cf1e3b931c03762c0628b4cef8a515ef5e44f7 100644
--- a/ACI.txt
+++ b/ACI.txt
@@ -112,6 +112,8 @@ dn: cn=System: Read Sudoers compat tree,cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetattr = "cn || description || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=ipa,dc=example";)(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///all";;)
 dn: cn=System: Read Trust Information,cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetattr = "cn || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrusteddomainsid || ipanttrustpartner || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";;)
+dn: cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetattr = "gidnumber || krbprincipalname || uidnumber")(version 3.0;acl "permission:System: Read system trust accounts";allow (compare,read,search) groupdn = "ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=System: Add User to default group,cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetattr = "member")(target = "ldap:///cn=ipausers,cn=groups,cn=accounts,dc=ipa,dc=example";)(version 3.0;acl "permission:System: Add User to default group";allow (write) groupdn = "ldap:///cn=System: Add User to default group,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=System: Add Users,cn=permissions,cn=pbac,dc=ipa,dc=example
diff --git a/install/updates/60-trusts.update b/install/updates/60-trusts.update
index 371bf656fcdea6b7ec54aeb42c5afd25ef1b90f9..d55bc94bbe917571999bcc7dfb6e6aaf641c4b49 100644
--- a/install/updates/60-trusts.update
+++ b/install/updates/60-trusts.update
@@ -15,6 +15,14 @@ default: objectClass: GroupOfNames
 default: objectClass: top
 default: cn: adtrust agents
 
+dn: cn=ADTrust Agents,cn=privileges,cn=pbac,$SUFFIX
+default: objectClass: top
+default: objectClass: groupofnames
+default: objectClass: nestedgroup
+default: cn: ADTrust Agents
+default: description: System accounts able to access trust information
+default: member: cn=adtrust agents,cn=sysaccounts,cn=etc,$SUFFIX
+
 dn: cn=trusts,$SUFFIX
 default: objectClass: top
 default: objectClass: nsContainer
diff --git a/ipalib/plugins/trust.py b/ipalib/plugins/trust.py
index 25755d7a41e93b869f4d4afbf0ac094c42212451..99acfb8f8ce1532e4406087af3f9c158fc313159 100644
--- a/ipalib/plugins/trust.py
+++ b/ipalib/plugins/trust.py
@@ -330,6 +330,17 @@ class trust(LDAPObject):
                 'ipantsidblacklistincoming', 'ipantsidblacklistoutgoing'
             },
         },
+
+        'System: Read system trust accounts': {
+            'non_object': True,
+            'ipapermlocation': DN(container_dn, api.env.basedn),
+            'replaces_global_anonymous_aci': True,
+            'ipapermright': {'read', 'search', 'compare'},
+            'ipapermdefaultattr': {
+                'uidnumber', 'gidnumber', 'krbprincipalname'
+            },
+            'default_privileges': {'ADTrust Agents'},
+        },
     }
 
     label = _('Trusts')
-- 
1.9.3

_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel

Reply via email to