[Freeipa-users] Granting rights temporarily

2013-02-14 Thread Dag Wieers
Hi, Another interesting recommendation from security is that all granted access (that is exceptional, rather than permanent) should be limited in time from the onset. If this is not possible all granted access needs to be documented and revised regularly. However a system that would

Re: [Freeipa-users] Granting rights temporarily

2013-02-14 Thread Natxo Asenjo
On Thu, Feb 14, 2013 at 10:02 AM, Dag Wieers d...@wieers.com wrote: Hi, Another interesting recommendation from security is that all granted access (that is exceptional, rather than permanent) should be limited in time from the onset. If this is not possible all granted access needs to be

Re: [Freeipa-users] Granting rights temporarily

2013-02-14 Thread Alexander Bokovoy
On Thu, 14 Feb 2013, Dag Wieers wrote: Hi, Another interesting recommendation from security is that all granted access (that is exceptional, rather than permanent) should be limited in time from the onset. If this is not possible all granted access needs to be documented and revised

Re: [Freeipa-users] Granting rights temporarily

2013-02-14 Thread Simo Sorce
On Thu, 2013-02-14 at 10:02 +0100, Dag Wieers wrote: Hi, Another interesting recommendation from security is that all granted access (that is exceptional, rather than permanent) should be limited in time from the onset. If this is not possible all granted access needs to be documented

Re: [Freeipa-users] Granting rights temporarily

2013-02-14 Thread Rich Megginson
On 02/14/2013 06:54 AM, Simo Sorce wrote: On Thu, 2013-02-14 at 10:02 +0100, Dag Wieers wrote: Hi, Another interesting recommendation from security is that all granted access (that is exceptional, rather than permanent) should be limited in time from the onset. If this is not possible all

Re: [Freeipa-users] Granting rights temporarily

2013-02-14 Thread Dag Wieers
On Thu, 14 Feb 2013, Alexander Bokovoy wrote: On Thu, 14 Feb 2013, Dag Wieers wrote: So I was wondering whether this is something that was already discussed as a feature for IPA ? Yes, something along these lines was discussed in past. We have three tickets so far in deferred state: https:

Re: [Freeipa-users] Granting rights temporarily

2013-02-14 Thread Simo Sorce
On Thu, 2013-02-14 at 08:30 -0700, Rich Megginson wrote: On 02/14/2013 06:54 AM, Simo Sorce wrote: On Thu, 2013-02-14 at 10:02 +0100, Dag Wieers wrote: Hi, Another interesting recommendation from security is that all granted access (that is exceptional, rather than permanent) should be