Re: [Freeipa-devel] [PATCH 0233] trusts: Add more read attributes
On 06/24/2014 08:15 PM, Tomas Babej wrote:
Attaching patch 234, which resolves another ACI issue related to trusts.
On 06/24/2014 02:50 PM, Tomas Babej wrote:
Hi,
this is a follow up patch for 232. Read access to additional attributes
is required for the trust objects.
First patch looks fine.
For the second: should the trust ACIs apply to other objects than
(objectclas=ipanttrusteddomain)?
If not, we can enable --type=trust permissions and use it to specify
location filter, see attached patch.
--
Petr³
From 075e6b669b7504cb0fbad15a6e2fec4f73c35851 Mon Sep 17 00:00:00 2001
From: Tomas Babej tba...@redhat.com
Date: Tue, 24 Jun 2014 18:24:32 +0200
Subject: [PATCH] trusts: Allow reading system trust accounts by adtrust agents
---
ACI.txt | 4 +++-
install/updates/60-trusts.update | 8
ipalib/plugins/trust.py | 12 ++--
3 files changed, 21 insertions(+), 3 deletions(-)
diff --git a/ACI.txt b/ACI.txt
index 687b1ef3017dd9b2388c1d413ed9f6ac211df406..9f1edce0ef293a2157015db79f9b1e4a36a83d64 100644
--- a/ACI.txt
+++ b/ACI.txt
@@ -213,7 +213,9 @@ aci: (targetattr = cmdcategory || cn || description || externalhost || external
dn: cn=System: Read Sudoers compat tree,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetattr = cn || description || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser)(target = ldap:///ou=sudoers,dc=ipa,dc=example;)(version 3.0;acl permission:System: Read Sudoers compat tree;allow (compare,read,search) userdn = ldap:///all;;)
dn: cn=System: Read Trust Information,cn=permissions,cn=pbac,dc=ipa,dc=example
-aci: (targetattr = cn || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrusteddomainsid || ipanttrustpartner || objectclass)(version 3.0;acl permission:System: Read Trust Information;allow (compare,read,search) userdn = ldap:///all;;)
+aci: (targetattr = cn || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrusteddomainsid || ipanttrustpartner || objectclass)(targetfilter = (objectclass=ipanttrusteddomain))(version 3.0;acl permission:System: Read Trust Information;allow (compare,read,search) userdn = ldap:///all;;)
+dn: cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetattr = gidnumber || uidnumber)(targetfilter = (objectclass=ipanttrusteddomain))(version 3.0;acl permission:System: Read system trust accounts;allow (compare,read,search) groupdn = ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=ipa,dc=example;)
dn: cn=System: Add User to default group,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetattr = member)(target = ldap:///cn=ipausers,cn=groups,cn=accounts,dc=ipa,dc=example;)(version 3.0;acl permission:System: Add User to default group;allow (write) groupdn = ldap:///cn=System: Add User to default group,cn=permissions,cn=pbac,dc=ipa,dc=example;)
dn: cn=System: Add Users,cn=permissions,cn=pbac,dc=ipa,dc=example
diff --git a/install/updates/60-trusts.update b/install/updates/60-trusts.update
index 371bf656fcdea6b7ec54aeb42c5afd25ef1b90f9..d55bc94bbe917571999bcc7dfb6e6aaf641c4b49 100644
--- a/install/updates/60-trusts.update
+++ b/install/updates/60-trusts.update
@@ -15,6 +15,14 @@ dn: cn=adtrust agents,cn=sysaccounts,cn=etc,$SUFFIX
default: objectClass: top
default: cn: adtrust agents
+dn: cn=ADTrust Agents,cn=privileges,cn=pbac,$SUFFIX
+default: objectClass: top
+default: objectClass: groupofnames
+default: objectClass: nestedgroup
+default: cn: ADTrust Agents
+default: description: System accounts able to access trust information
+default: member: cn=adtrust agents,cn=sysaccounts,cn=etc,$SUFFIX
+
dn: cn=trusts,$SUFFIX
default: objectClass: top
default: objectClass: nsContainer
diff --git a/ipalib/plugins/trust.py b/ipalib/plugins/trust.py
index 25755d7a41e93b869f4d4afbf0ac094c42212451..f850a358b26ca2284d7e238770f6e67fde1dd9d2 100644
--- a/ipalib/plugins/trust.py
+++ b/ipalib/plugins/trust.py
@@ -309,6 +309,7 @@ class trust(LDAPObject):
object_name = _('trust')
object_name_plural = _('trusts')
object_class = ['ipaNTTrustedDomain']
+permission_filter_objectclasses = ['ipanttrusteddomain']
default_attributes = ['cn', 'ipantflatname', 'ipanttrusteddomainsid',
'ipanttrusttype', 'ipanttrustattributes', 'ipanttrustdirection',
'ipanttrustpartner', 'ipanttrustforesttrustinfo',
@@ -318,8 +319,6 @@ class trust(LDAPObject):
managed_permissions = {
'System: Read Trust Information': {
# Allow reading of attributes needed for SSSD subdomains support
-'non_object': True,
-'ipapermlocation': DN(container_dn, api.env.basedn),
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'all',
Re: [Freeipa-devel] [PATCH 0233] trusts: Add more read attributes
On 06/25/2014 11:45 AM, Petr Viktorin wrote:
On 06/24/2014 08:15 PM, Tomas Babej wrote:
Attaching patch 234, which resolves another ACI issue related to trusts.
On 06/24/2014 02:50 PM, Tomas Babej wrote:
Hi,
this is a follow up patch for 232. Read access to additional attributes
is required for the trust objects.
First patch looks fine.
For the second: should the trust ACIs apply to other objects than
(objectclas=ipanttrusteddomain)?
If not, we can enable --type=trust permissions and use it to specify
location filter, see attached patch.
Turns out there are also kerberos principals stored under cn=trust tree
and this filter would block the access to them.
Attached is a new version of 234, which allows reading krbPrincipalName
as well.
--
Tomas Babej
Associate Software Engineer | Red Hat | Identity Management
RHCE | Brno Site | IRC: tbabej | freeipa.org
From 536b386a9196957edccc8731c1c2d9ed204c69e3 Mon Sep 17 00:00:00 2001
From: Tomas Babej tba...@redhat.com
Date: Tue, 24 Jun 2014 18:24:32 +0200
Subject: [PATCH] trusts: Allow reading system trust accounts by adtrust agents
---
ACI.txt | 2 ++
install/updates/60-trusts.update | 8
ipalib/plugins/trust.py | 11 +++
3 files changed, 21 insertions(+)
diff --git a/ACI.txt b/ACI.txt
index 0398a52fcf2639f895f6bb7cd8bd91412affa6d3..43cf1e3b931c03762c0628b4cef8a515ef5e44f7 100644
--- a/ACI.txt
+++ b/ACI.txt
@@ -112,6 +112,8 @@ dn: cn=System: Read Sudoers compat tree,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetattr = cn || description || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser)(target = ldap:///ou=sudoers,dc=ipa,dc=example;)(version 3.0;acl permission:System: Read Sudoers compat tree;allow (compare,read,search) userdn = ldap:///all;;)
dn: cn=System: Read Trust Information,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetattr = cn || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrusteddomainsid || ipanttrustpartner || objectclass)(version 3.0;acl permission:System: Read Trust Information;allow (compare,read,search) userdn = ldap:///all;;)
+dn: cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetattr = gidnumber || krbprincipalname || uidnumber)(version 3.0;acl permission:System: Read system trust accounts;allow (compare,read,search) groupdn = ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=ipa,dc=example;)
dn: cn=System: Add User to default group,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetattr = member)(target = ldap:///cn=ipausers,cn=groups,cn=accounts,dc=ipa,dc=example;)(version 3.0;acl permission:System: Add User to default group;allow (write) groupdn = ldap:///cn=System: Add User to default group,cn=permissions,cn=pbac,dc=ipa,dc=example;)
dn: cn=System: Add Users,cn=permissions,cn=pbac,dc=ipa,dc=example
diff --git a/install/updates/60-trusts.update b/install/updates/60-trusts.update
index 371bf656fcdea6b7ec54aeb42c5afd25ef1b90f9..d55bc94bbe917571999bcc7dfb6e6aaf641c4b49 100644
--- a/install/updates/60-trusts.update
+++ b/install/updates/60-trusts.update
@@ -15,6 +15,14 @@ default: objectClass: GroupOfNames
default: objectClass: top
default: cn: adtrust agents
+dn: cn=ADTrust Agents,cn=privileges,cn=pbac,$SUFFIX
+default: objectClass: top
+default: objectClass: groupofnames
+default: objectClass: nestedgroup
+default: cn: ADTrust Agents
+default: description: System accounts able to access trust information
+default: member: cn=adtrust agents,cn=sysaccounts,cn=etc,$SUFFIX
+
dn: cn=trusts,$SUFFIX
default: objectClass: top
default: objectClass: nsContainer
diff --git a/ipalib/plugins/trust.py b/ipalib/plugins/trust.py
index 25755d7a41e93b869f4d4afbf0ac094c42212451..99acfb8f8ce1532e4406087af3f9c158fc313159 100644
--- a/ipalib/plugins/trust.py
+++ b/ipalib/plugins/trust.py
@@ -330,6 +330,17 @@ class trust(LDAPObject):
'ipantsidblacklistincoming', 'ipantsidblacklistoutgoing'
},
},
+
+'System: Read system trust accounts': {
+'non_object': True,
+'ipapermlocation': DN(container_dn, api.env.basedn),
+'replaces_global_anonymous_aci': True,
+'ipapermright': {'read', 'search', 'compare'},
+'ipapermdefaultattr': {
+'uidnumber', 'gidnumber', 'krbprincipalname'
+},
+'default_privileges': {'ADTrust Agents'},
+},
}
label = _('Trusts')
--
1.9.3
___
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH 0233] trusts: Add more read attributes
On Wed, 25 Jun 2014, Tomas Babej wrote: On 06/25/2014 11:45 AM, Petr Viktorin wrote: On 06/24/2014 08:15 PM, Tomas Babej wrote: Attaching patch 234, which resolves another ACI issue related to trusts. On 06/24/2014 02:50 PM, Tomas Babej wrote: Hi, this is a follow up patch for 232. Read access to additional attributes is required for the trust objects. First patch looks fine. For the second: should the trust ACIs apply to other objects than (objectclas=ipanttrusteddomain)? If not, we can enable --type=trust permissions and use it to specify location filter, see attached patch. Turns out there are also kerberos principals stored under cn=trust tree and this filter would block the access to them. Attached is a new version of 234, which allows reading krbPrincipalName as well. ACK. -- / Alexander Bokovoy ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH 0233] trusts: Add more read attributes
On 06/25/2014 01:54 PM, Alexander Bokovoy wrote: On Wed, 25 Jun 2014, Tomas Babej wrote: On 06/25/2014 11:45 AM, Petr Viktorin wrote: On 06/24/2014 08:15 PM, Tomas Babej wrote: Attaching patch 234, which resolves another ACI issue related to trusts. On 06/24/2014 02:50 PM, Tomas Babej wrote: Hi, this is a follow up patch for 232. Read access to additional attributes is required for the trust objects. First patch looks fine. For the second: should the trust ACIs apply to other objects than (objectclas=ipanttrusteddomain)? If not, we can enable --type=trust permissions and use it to specify location filter, see attached patch. Turns out there are also kerberos principals stored under cn=trust tree and this filter would block the access to them. Attached is a new version of 234, which allows reading krbPrincipalName as well. ACK. Pushed to master: c2e6b74029e08a4eadb7a14a4c711febfc83b5be -- Petr³ ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH 0233] trusts: Add more read attributes
Attaching patch 234, which resolves another ACI issue related to trusts.
On 06/24/2014 02:50 PM, Tomas Babej wrote:
Hi,
this is a follow up patch for 232. Read access to additional attributes
is required for the trust objects.
___
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
--
Tomas Babej
Associate Software Engineer | Red Hat | Identity Management
RHCE | Brno Site | IRC: tbabej | freeipa.org
From 629dc5ba07ef9490ba7dbce33306b02c3494893d Mon Sep 17 00:00:00 2001
From: Tomas Babej tba...@redhat.com
Date: Tue, 24 Jun 2014 18:24:32 +0200
Subject: [PATCH] trusts: Allow reading system trust accounts by adtrust agents
---
ACI.txt | 2 ++
install/updates/60-trusts.update | 8
ipalib/plugins/trust.py | 11 +++
3 files changed, 21 insertions(+)
diff --git a/ACI.txt b/ACI.txt
index 0398a52fcf2639f895f6bb7cd8bd91412affa6d3..94e3f2850d84c3819772504e21b44246306c6be8 100644
--- a/ACI.txt
+++ b/ACI.txt
@@ -112,6 +112,8 @@ dn: cn=System: Read Sudoers compat tree,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetattr = cn || description || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser)(target = ldap:///ou=sudoers,dc=ipa,dc=example;)(version 3.0;acl permission:System: Read Sudoers compat tree;allow (compare,read,search) userdn = ldap:///all;;)
dn: cn=System: Read Trust Information,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetattr = cn || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrusteddomainsid || ipanttrustpartner || objectclass)(version 3.0;acl permission:System: Read Trust Information;allow (compare,read,search) userdn = ldap:///all;;)
+dn: cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetattr = gidnumber || uidnumber)(version 3.0;acl permission:System: Read system trust accounts;allow (compare,read,search) groupdn = ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=ipa,dc=example;)
dn: cn=System: Add User to default group,cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetattr = member)(target = ldap:///cn=ipausers,cn=groups,cn=accounts,dc=ipa,dc=example;)(version 3.0;acl permission:System: Add User to default group;allow (write) groupdn = ldap:///cn=System: Add User to default group,cn=permissions,cn=pbac,dc=ipa,dc=example;)
dn: cn=System: Add Users,cn=permissions,cn=pbac,dc=ipa,dc=example
diff --git a/install/updates/60-trusts.update b/install/updates/60-trusts.update
index 371bf656fcdea6b7ec54aeb42c5afd25ef1b90f9..d55bc94bbe917571999bcc7dfb6e6aaf641c4b49 100644
--- a/install/updates/60-trusts.update
+++ b/install/updates/60-trusts.update
@@ -15,6 +15,14 @@ default: objectClass: GroupOfNames
default: objectClass: top
default: cn: adtrust agents
+dn: cn=ADTrust Agents,cn=privileges,cn=pbac,$SUFFIX
+default: objectClass: top
+default: objectClass: groupofnames
+default: objectClass: nestedgroup
+default: cn: ADTrust Agents
+default: description: System accounts able to access trust information
+default: member: cn=adtrust agents,cn=sysaccounts,cn=etc,$SUFFIX
+
dn: cn=trusts,$SUFFIX
default: objectClass: top
default: objectClass: nsContainer
diff --git a/ipalib/plugins/trust.py b/ipalib/plugins/trust.py
index 25755d7a41e93b869f4d4afbf0ac094c42212451..565d87a77a923ac29763be5ffad8c8c67cd01588 100644
--- a/ipalib/plugins/trust.py
+++ b/ipalib/plugins/trust.py
@@ -330,6 +330,17 @@ class trust(LDAPObject):
'ipantsidblacklistincoming', 'ipantsidblacklistoutgoing'
},
},
+
+'System: Read system trust accounts': {
+'non_object': True,
+'ipapermlocation': DN(container_dn, api.env.basedn),
+'replaces_global_anonymous_aci': True,
+'ipapermright': {'read', 'search', 'compare'},
+'ipapermdefaultattr': {
+'uidnumber', 'gidnumber'
+},
+'default_privileges': {'ADTrust Agents'},
+},
}
label = _('Trusts')
--
1.9.3
___
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
