Add the permission to Stage users administrators to delete already preserved user


From a1d4905af6784e12b0a47a32418ec5e3d5a7d769 Mon Sep 17 00:00:00 2001
From: root <r...@vm-205.idm.lab.eng.brq.redhat.com>
Date: Fri, 19 Jun 2015 17:27:11 +0200
Subject: [PATCH] User life cycle: permission to delete a preserved user

Add permission to delete an entry from Delete container

https://fedorahosted.org/freeipa/ticket/3813
---
 ACI.txt                     |  2 ++
 ipalib/plugins/stageuser.py | 10 ++++++++++
 2 files changed, 12 insertions(+)

diff --git a/ACI.txt b/ACI.txt
index 4d019cbc2c8ee6ad8051b1eb975964ebca64d7a0..9206d76ed55aaabd278452ba08cf202a4eab1200 100644
--- a/ACI.txt
+++ b/ACI.txt
@@ -265,6 +265,8 @@ aci: (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=p
 dn: cn=staged users,cn=accounts,cn=provisioning,dc=ipa,dc=example
 aci: (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=ipa,dc=example")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove Stage User";allow (delete) groupdn = "ldap:///cn=System: Remove Stage User,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example
+aci: (targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove preserved User";allow (delete) groupdn = "ldap:///cn=System: Remove preserved User,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example
 aci: (targetattr = "krblastpwdchange || krbpasswordexpiration || krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Reset Preserved User password";allow (read,search,write) groupdn = "ldap:///cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: dc=ipa,dc=example
 aci: (target_to = "ldap:///cn=users,cn=accounts,dc=ipa,dc=example";)(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=ipa,dc=example";)
diff --git a/ipalib/plugins/stageuser.py b/ipalib/plugins/stageuser.py
index 18e09e957158bd53bdb8d295a8bf91a823e16ca7..7c714f627f000f7b013b60b096e72587cf935022 100644
--- a/ipalib/plugins/stageuser.py
+++ b/ipalib/plugins/stageuser.py
@@ -202,6 +202,16 @@ class stageuser(baseuser):
             },
             'default_privileges': {'Stage User Administrators'},
         },
+        # Allow to delete preserved user
+        'System: Remove preserved User': {
+            'ipapermlocation': DN(baseuser.delete_container_dn, api.env.basedn),
+            'ipapermbindruletype': 'permission',
+            'ipapermtarget': DN('uid=*', baseuser.delete_container_dn, api.env.basedn),
+            'ipapermtargetfilter': {'(objectclass=*)'},
+            'ipapermright': {'delete'},
+            'ipapermdefaultattr': {'*'},
+            'default_privileges': {'Stage User Administrators'},
+        },
         #
         # Active container
         #
-- 
2.1.0

-- 
Manage your subscription for the Freeipa-devel mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-devel
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code

Reply via email to