Re: [Freeipa-devel] [PATCH] 0525 Add managed read permissions to automember

2014-04-17 Thread Petr Viktorin 

On 04/16/2014 04:35 PM, Martin Kosek wrote:

On 04/15/2014 02:33 PM, Petr Viktorin wrote:

Read access to both rules and definitions is given to a new privilege,
'Automember Readers', as well as the existing 'Automember Task Administrator'.


This needs a mild rebase in 40-delegation.update. When I resolved the conflict
patch worked fine, no problem found.

ACK when you fix the conflict.


Rebased to current master.


--
Petr³
From 12c06f859140bb5820c326207001e45f35c938e4 Mon Sep 17 00:00:00 2001
From: Petr Viktorin pvikt...@redhat.com
Date: Wed, 26 Mar 2014 17:11:23 +0100
Subject: [PATCH] Add managed read permissions to automember

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
---
 install/updates/40-delegation.update |  7 +++
 ipalib/plugins/automember.py | 29 +
 2 files changed, 36 insertions(+)

diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update
index 6ab849bf86d129ef93472e970705b117147f0818..69061ca3df0cde8f66816e2f2f09aa15405a369e 100644
--- a/install/updates/40-delegation.update
+++ b/install/updates/40-delegation.update
@@ -415,3 +415,10 @@ dn: cn=Kerberos Ticket Policy Readers,cn=privileges,cn=pbac,$SUFFIX
 default:objectClass: top
 default:cn: Kerberos Ticket Policy Readers
 default:description: Read global and per-user Kerberos ticket policy
+
+dn: cn=Automember Readers,cn=privileges,cn=pbac,$SUFFIX
+default:objectClass: nestedgroup
+default:objectClass: groupofnames
+default:objectClass: top
+default:cn: Automember Readers
+default:description: Read Automember definitions
diff --git a/ipalib/plugins/automember.py b/ipalib/plugins/automember.py
index 4b3f6f06f80ca8d20245a784ac2ba9a07c17a3e9..dad35d45850e56e90ea5f6a30769badec6941119 100644
--- a/ipalib/plugins/automember.py
+++ b/ipalib/plugins/automember.py
@@ -183,10 +183,39 @@ class automember(LDAPObject):
 object_name = 'Automember rule'
 object_name_plural = 'Automember rules'
 object_class = ['top', 'automemberregexrule']
+permission_filter_objectclasses = ['automemberregexrule']
 default_attributes = [
 'automemberinclusiveregex', 'automemberexclusiveregex',
 'cn', 'automembertargetgroup', 'description', 'automemberdefaultgroup'
 ]
+managed_permissions = {
+'System: Read Automember Definitions': {
+'non_object': True,
+'ipapermlocation': DN(container_dn, api.env.basedn),
+'ipapermtargetfilter': {'(objectclass=automemberdefinition)'},
+'replaces_global_anonymous_aci': True,
+'ipapermbindruletype': 'permission',
+'ipapermright': {'read', 'search', 'compare'},
+'ipapermdefaultattr': {
+'objectclass', 'cn', 'automemberscope', 'automemberfilter',
+'automembergroupingattr', 'automemberdefaultgroup',
+'automemberdisabled',
+},
+'default_privileges': {'Automember Readers',
+   'Automember Task Administrator'},
+},
+'System: Read Automember Rules': {
+'replaces_global_anonymous_aci': True,
+'ipapermbindruletype': 'permission',
+'ipapermright': {'read', 'search', 'compare'},
+'ipapermdefaultattr': {
+'cn', 'objectclass', 'automembertargetgroup', 'description',
+'automemberexclusiveregex', 'automemberinclusiveregex',
+},
+'default_privileges': {'Automember Readers',
+   'Automember Task Administrator'},
+},
+}
 
 label = _('Auto Membership Rule')
 
-- 
1.9.0

___
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel

Re: [Freeipa-devel] [PATCH] 0525 Add managed read permissions to automember

2014-04-17 Thread Martin Kosek 
On 04/17/2014 12:03 PM, Petr Viktorin wrote:
 On 04/16/2014 04:35 PM, Martin Kosek wrote:
 On 04/15/2014 02:33 PM, Petr Viktorin wrote:
 Read access to both rules and definitions is given to a new privilege,
 'Automember Readers', as well as the existing 'Automember Task 
 Administrator'.

 This needs a mild rebase in 40-delegation.update. When I resolved the 
 conflict
 patch worked fine, no problem found.

 ACK when you fix the conflict.
 
 Rebased to current master.

This is ok, ACK.

Pushed to master: 1e46c0a36159c990e083f771de2c0a18ecdbc42e

Martin

___
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel

Re: [Freeipa-devel] [PATCH] 0525 Add managed read permissions to automember

2014-04-16 Thread Martin Kosek 
On 04/15/2014 02:33 PM, Petr Viktorin wrote:
 Read access to both rules and definitions is given to a new privilege,
 'Automember Readers', as well as the existing 'Automember Task Administrator'.

This needs a mild rebase in 40-delegation.update. When I resolved the conflict
patch worked fine, no problem found.

ACK when you fix the conflict.

Martin

___
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel

[Freeipa-devel] [PATCH] 0525 Add managed read permissions to automember

2014-04-15 Thread Petr Viktorin 
Read access to both rules and definitions is given to a new privilege, 
'Automember Readers', as well as the existing 'Automember Task 
Administrator'.



--
Petr³
From d5d9ca67a3ac3219807efddad4670c71d54f5501 Mon Sep 17 00:00:00 2001
From: Petr Viktorin pvikt...@redhat.com
Date: Wed, 26 Mar 2014 17:11:23 +0100
Subject: [PATCH] Add managed read permissions to automember

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
---
 install/updates/40-delegation.update |  7 +++
 ipalib/plugins/automember.py | 29 +
 2 files changed, 36 insertions(+)

diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update
index 27e605789ba152ac61796217ca12a603958931c1..d69ade6b347130a40779e1b2159a42761381da8e 100644
--- a/install/updates/40-delegation.update
+++ b/install/updates/40-delegation.update
@@ -408,3 +408,10 @@ dn: cn=Password Policy Readers,cn=privileges,cn=pbac,$SUFFIX
 default:objectClass: top
 default:cn: Password Policy Readers
 default:description: Read password policies
+
+dn: cn=Automember Readers,cn=privileges,cn=pbac,$SUFFIX
+default:objectClass: nestedgroup
+default:objectClass: groupofnames
+default:objectClass: top
+default:cn: Automember Readers
+default:description: Read Automember definitions
diff --git a/ipalib/plugins/automember.py b/ipalib/plugins/automember.py
index 4b3f6f06f80ca8d20245a784ac2ba9a07c17a3e9..dad35d45850e56e90ea5f6a30769badec6941119 100644
--- a/ipalib/plugins/automember.py
+++ b/ipalib/plugins/automember.py
@@ -183,10 +183,39 @@ class automember(LDAPObject):
 object_name = 'Automember rule'
 object_name_plural = 'Automember rules'
 object_class = ['top', 'automemberregexrule']
+permission_filter_objectclasses = ['automemberregexrule']
 default_attributes = [
 'automemberinclusiveregex', 'automemberexclusiveregex',
 'cn', 'automembertargetgroup', 'description', 'automemberdefaultgroup'
 ]
+managed_permissions = {
+'System: Read Automember Definitions': {
+'non_object': True,
+'ipapermlocation': DN(container_dn, api.env.basedn),
+'ipapermtargetfilter': {'(objectclass=automemberdefinition)'},
+'replaces_global_anonymous_aci': True,
+'ipapermbindruletype': 'permission',
+'ipapermright': {'read', 'search', 'compare'},
+'ipapermdefaultattr': {
+'objectclass', 'cn', 'automemberscope', 'automemberfilter',
+'automembergroupingattr', 'automemberdefaultgroup',
+'automemberdisabled',
+},
+'default_privileges': {'Automember Readers',
+   'Automember Task Administrator'},
+},
+'System: Read Automember Rules': {
+'replaces_global_anonymous_aci': True,
+'ipapermbindruletype': 'permission',
+'ipapermright': {'read', 'search', 'compare'},
+'ipapermdefaultattr': {
+'cn', 'objectclass', 'automembertargetgroup', 'description',
+'automemberexclusiveregex', 'automemberinclusiveregex',
+},
+'default_privileges': {'Automember Readers',
+   'Automember Task Administrator'},
+},
+}
 
 label = _('Auto Membership Rule')
 
-- 
1.9.0

___
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel