URL: https://github.com/freeipa/freeipa/pull/565
Author: pvoborni
 Title: #565: permissions: add permissions for reading and modifying external 
group members
Action: opened

PR body:
"""
Issue: "User Administrator" role cannot add users to an External Group.

https://fedorahosted.org/freeipa/ticket/5504


"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/565/head:pr565
git checkout pr565
From 77c0b6ced4428f8e82f7546086a56b91b22fbf0b Mon Sep 17 00:00:00 2001
From: Petr Vobornik <pvobo...@redhat.com>
Date: Thu, 23 Jun 2016 17:42:17 +0200
Subject: [PATCH] permissions: add permissions for read and mod of external
 group members

Issue: "User Administrator" role cannot add users to an External Group.

https://fedorahosted.org/freeipa/ticket/5504
---
 ipaserver/plugins/group.py | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/ipaserver/plugins/group.py b/ipaserver/plugins/group.py
index 67a264a..218da3c 100644
--- a/ipaserver/plugins/group.py
+++ b/ipaserver/plugins/group.py
@@ -194,6 +194,13 @@ class group(LDAPObject):
                 'member', 'memberof', 'memberuid', 'memberuser', 'memberhost',
             },
         },
+        'System: Read External Group Membership': {
+            'ipapermbindruletype': 'all',
+            'ipapermright': {'read', 'search', 'compare'},
+            'ipapermdefaultattr': {
+                'ipaexternalmember',
+            },
+        },
         'System: Add Groups': {
             'ipapermright': {'add'},
             'replaces': [
@@ -216,6 +223,16 @@ class group(LDAPObject):
                 'Group Administrators', 'Modify Group membership'
             },
         },
+        'System: Modify External Group Membership': {
+            'ipapermright': {'write'},
+            'ipapermtargetfilter': [
+                '(objectclass=ipaexternalgroup)',
+            ],
+            'ipapermdefaultattr': {'ipaexternalmember'},
+            'default_privileges': {
+                'Group Administrators', 'Modify Group membership'
+            },
+        },
         'System: Modify Groups': {
             'ipapermright': {'write'},
             'ipapermdefaultattr': {
-- 
Manage your subscription for the Freeipa-devel mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-devel
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code

Reply via email to