Re: [Freeipa-devel] [PATCH] 633 add selfservice aci plugin
On 12/07/2010 10:54 PM, Rob Crittenden wrote: Adam Young wrote: On 12/07/2010 04:33 PM, Rob Crittenden wrote: Add plugin for manage self-service ACIs This is just a thin wrapper around the aci plugin, controlling what types of ACIs can be added. Right now only ACIs in the basedn can be managed with this plugin. I've got an e-mail into the UI folks to see if we can enhance this and ask the type of object we're creating a selfservice entry for. This way we can put the aci into the proper container. Otherwise I'm going to need to follow up to this and move a couple of self-service ACI's that are now in containers into the basedn. ticket 531 rob ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel Probably related to the failure above, after that, doin ipa permission-find gave an error with the following in the log: Sun Dec 05 20:09:51 2010] [error] ipa: ERROR: non-public: TypeError: tuple indices must be integers, not str [Sun Dec 05 20:09:51 2010] [error] Traceback (most recent call last): [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipaserver/rpcserver.py, line 211, in wsgi_execute [Sun Dec 05 20:09:51 2010] [error] result = self.Command[name](*args, **options) [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipalib/frontend.py, line 417, in __call__ [Sun Dec 05 20:09:51 2010] [error] ret = self.run(*args, **options) [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipalib/frontend.py, line 690, in run [Sun Dec 05 20:09:51 2010] [error] return self.execute(*args, **options) [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipalib/plugins/baseldap.py, line 1228, in execute [Sun Dec 05 20:09:51 2010] [error] more = callback(ldap, entries, truncated, *args, **options) [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipalib/plugins/permission.py, line 313, in post_callback [Sun Dec 05 20:09:51 2010] [error] if aci['permission'] == entry['cn']: [Sun Dec 05 20:09:51 2010] [error] TypeError: tuple indices must be integers, not str This would be a separate problem, can you file a ticket on it? rob Well, it happened after I applied the patch, so I think it is probably due to the selfservice patch. Is it really a new issue, or is it a regression that shouldn't have been introduced? ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 633 add selfservice aci plugin
On 12/08/2010 12:48 PM, Adam Young wrote: On 12/08/2010 11:02 AM, Rob Crittenden wrote: Adam Young wrote: On 12/07/2010 10:54 PM, Rob Crittenden wrote: Adam Young wrote: On 12/07/2010 04:33 PM, Rob Crittenden wrote: Add plugin for manage self-service ACIs This is just a thin wrapper around the aci plugin, controlling what types of ACIs can be added. Right now only ACIs in the basedn can be managed with this plugin. I've got an e-mail into the UI folks to see if we can enhance this and ask the type of object we're creating a selfservice entry for. This way we can put the aci into the proper container. Otherwise I'm going to need to follow up to this and move a couple of self-service ACI's that are now in containers into the basedn. ticket 531 rob ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel Probably related to the failure above, after that, doin ipa permission-find gave an error with the following in the log: Sun Dec 05 20:09:51 2010] [error] ipa: ERROR: non-public: TypeError: tuple indices must be integers, not str [Sun Dec 05 20:09:51 2010] [error] Traceback (most recent call last): [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipaserver/rpcserver.py, line 211, in wsgi_execute [Sun Dec 05 20:09:51 2010] [error] result = self.Command[name](*args, **options) [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipalib/frontend.py, line 417, in __call__ [Sun Dec 05 20:09:51 2010] [error] ret = self.run(*args, **options) [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipalib/frontend.py, line 690, in run [Sun Dec 05 20:09:51 2010] [error] return self.execute(*args, **options) [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipalib/plugins/baseldap.py, line 1228, in execute [Sun Dec 05 20:09:51 2010] [error] more = callback(ldap, entries, truncated, *args, **options) [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipalib/plugins/permission.py, line 313, in post_callback [Sun Dec 05 20:09:51 2010] [error] if aci['permission'] == entry['cn']: [Sun Dec 05 20:09:51 2010] [error] TypeError: tuple indices must be integers, not str This would be a separate problem, can you file a ticket on it? rob Well, it happened after I applied the patch, so I think it is probably due to the selfservice patch. Is it really a new issue, or is it a regression that shouldn't have been introduced? Ok, not sure how my patch affected this but here is an updated patch with it fixed. rob So far so good, but it still has the issue with the perms being displayed Base64. Note that this is only on what is shown back the the user after they execute the command and are prompted for the permissions ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 633 add selfservice aci plugin
On 12/08/2010 01:34 PM, Rob Crittenden wrote: Adam Young wrote: On 12/08/2010 12:48 PM, Adam Young wrote: On 12/08/2010 11:02 AM, Rob Crittenden wrote: Adam Young wrote: On 12/07/2010 10:54 PM, Rob Crittenden wrote: Adam Young wrote: On 12/07/2010 04:33 PM, Rob Crittenden wrote: Add plugin for manage self-service ACIs This is just a thin wrapper around the aci plugin, controlling what types of ACIs can be added. Right now only ACIs in the basedn can be managed with this plugin. I've got an e-mail into the UI folks to see if we can enhance this and ask the type of object we're creating a selfservice entry for. This way we can put the aci into the proper container. Otherwise I'm going to need to follow up to this and move a couple of self-service ACI's that are now in containers into the basedn. ticket 531 rob ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel Probably related to the failure above, after that, doin ipa permission-find gave an error with the following in the log: Sun Dec 05 20:09:51 2010] [error] ipa: ERROR: non-public: TypeError: tuple indices must be integers, not str [Sun Dec 05 20:09:51 2010] [error] Traceback (most recent call last): [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipaserver/rpcserver.py, line 211, in wsgi_execute [Sun Dec 05 20:09:51 2010] [error] result = self.Command[name](*args, **options) [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipalib/frontend.py, line 417, in __call__ [Sun Dec 05 20:09:51 2010] [error] ret = self.run(*args, **options) [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipalib/frontend.py, line 690, in run [Sun Dec 05 20:09:51 2010] [error] return self.execute(*args, **options) [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipalib/plugins/baseldap.py, line 1228, in execute [Sun Dec 05 20:09:51 2010] [error] more = callback(ldap, entries, truncated, *args, **options) [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipalib/plugins/permission.py, line 313, in post_callback [Sun Dec 05 20:09:51 2010] [error] if aci['permission'] == entry['cn']: [Sun Dec 05 20:09:51 2010] [error] TypeError: tuple indices must be integers, not str This would be a separate problem, can you file a ticket on it? rob Well, it happened after I applied the patch, so I think it is probably due to the selfservice patch. Is it really a new issue, or is it a regression that shouldn't have been introduced? Ok, not sure how my patch affected this but here is an updated patch with it fixed. rob So far so good, but it still has the issue with the perms being displayed Base64. Note that this is only on what is shown back the the user after they execute the command and are prompted for the permissions Updated patch attached ACK. Pushed to master rob ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
[Freeipa-devel] [PATCH] 633 add selfservice aci plugin
Add plugin for manage self-service ACIs This is just a thin wrapper around the aci plugin, controlling what types of ACIs can be added. Right now only ACIs in the basedn can be managed with this plugin. I've got an e-mail into the UI folks to see if we can enhance this and ask the type of object we're creating a selfservice entry for. This way we can put the aci into the proper container. Otherwise I'm going to need to follow up to this and move a couple of self-service ACI's that are now in containers into the basedn. ticket 531 rob From b497133a497f2feaf81dd8e70efe3ca0ff7d947b Mon Sep 17 00:00:00 2001 From: Rob Crittenden rcrit...@redhat.com Date: Tue, 7 Dec 2010 16:30:37 -0500 Subject: [PATCH] Add plugin for manage self-service ACIs This is just a thin wrapper around the aci plugin, controlling what types of ACIs can be added. Right now only ACIs in the basedn can be managed with this plugin. ticket 531 --- ipalib/plugins/aci.py| 37 +++-- ipalib/plugins/selfservice.py| 192 ++ tests/test_xmlrpc/test_selfservice_plugin.py | 183 3 files changed, 398 insertions(+), 14 deletions(-) create mode 100644 ipalib/plugins/selfservice.py create mode 100644 tests/test_xmlrpc/test_selfservice_plugin.py diff --git a/ipalib/plugins/aci.py b/ipalib/plugins/aci.py index 3636ddd..d5f7d99 100644 --- a/ipalib/plugins/aci.py +++ b/ipalib/plugins/aci.py @@ -656,21 +656,30 @@ class aci_find(crud.Search): # acis = list(results) for a in acis: -if 'target' in a.target: -target = a.target['target']['expression'] -else: -results.remove(a) -continue -found = False -for k in _type_map.keys(): -if _type_map[k] == target and 'type' in kw and kw['type'] == k: -found = True -break; -if not found: -try: +if 'type' in kw: +if 'target' in a.target: +target = a.target['target']['expression'] +else: results.remove(a) -except ValueError: -pass +continue +found = False +for k in _type_map.keys(): +if _type_map[k] == target and kw['type'] == k: +found = True +break; +if not found: +try: +results.remove(a) +except ValueError: +pass + +if 'selfaci' in kw and kw['selfaci'] == True: +for a in acis: +if a.bindrule['expression'] != u'ldap:///self': +try: +results.remove(a) +except ValueError: +pass # TODO: searching by: filter, subtree diff --git a/ipalib/plugins/selfservice.py b/ipalib/plugins/selfservice.py new file mode 100644 index 000..aee07ab --- /dev/null +++ b/ipalib/plugins/selfservice.py @@ -0,0 +1,192 @@ +# Authors: +# Rob Crittenden rcrit...@redhat.com +# +# Copyright (C) 2010 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation; version 2 only +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + +Self-Service Permissions + +A permission enables fine-grained delegation of permissions. Access Control +Rules, or instructions (ACIs), grant permission to permissions to perform +given tasks such as adding a user, modifying a group, etc. + +A Self-Service permission defines what an object can change in its own entry. + + +EXAMPLES: + + Add a self-service rule to allow users to manage their address: + ipa selfservice-add --permissions=write --attrs=street,postalCode,l,c,st User's manage their own address + + When managing the list of attributes you need to include all attributes + in the list, including existing ones. Add telephoneNumber to the list: + ipa selfservice-mod --attrs=street,postalCode,l,c,st,telephoneNumber User's manage their own address + + Display our updated rule: + ipa selfservice-show User's manage their own address + + Delete a rule: + ipa selfservice-del User's manage their own address + + +import copy +from ipalib import api, _,
Re: [Freeipa-devel] [PATCH] 633 add selfservice aci plugin
Adam Young wrote: On 12/07/2010 04:33 PM, Rob Crittenden wrote: Add plugin for manage self-service ACIs This is just a thin wrapper around the aci plugin, controlling what types of ACIs can be added. Right now only ACIs in the basedn can be managed with this plugin. I've got an e-mail into the UI folks to see if we can enhance this and ask the type of object we're creating a selfservice entry for. This way we can put the aci into the proper container. Otherwise I'm going to need to follow up to this and move a couple of self-service ACI's that are now in containers into the basedn. ticket 531 rob ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel Probably related to the failure above, after that, doin ipa permission-find gave an error with the following in the log: Sun Dec 05 20:09:51 2010] [error] ipa: ERROR: non-public: TypeError: tuple indices must be integers, not str [Sun Dec 05 20:09:51 2010] [error] Traceback (most recent call last): [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipaserver/rpcserver.py, line 211, in wsgi_execute [Sun Dec 05 20:09:51 2010] [error] result = self.Command[name](*args, **options) [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipalib/frontend.py, line 417, in __call__ [Sun Dec 05 20:09:51 2010] [error] ret = self.run(*args, **options) [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipalib/frontend.py, line 690, in run [Sun Dec 05 20:09:51 2010] [error] return self.execute(*args, **options) [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipalib/plugins/baseldap.py, line 1228, in execute [Sun Dec 05 20:09:51 2010] [error] more = callback(ldap, entries, truncated, *args, **options) [Sun Dec 05 20:09:51 2010] [error] File /usr/lib/python2.6/site-packages/ipalib/plugins/permission.py, line 313, in post_callback [Sun Dec 05 20:09:51 2010] [error] if aci['permission'] == entry['cn']: [Sun Dec 05 20:09:51 2010] [error] TypeError: tuple indices must be integers, not str This would be a separate problem, can you file a ticket on it? rob ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
