Re: [Freeipa-users] User Roles and access in GUI

2013-04-16 Thread Martin Kosek
On 04/16/2013 03:16 AM, Dmitri Pal wrote: On 04/15/2013 07:42 PM, Chandan Kumar wrote: I agree it won't be a security feature nor you are doing wrong by not adding it. However, it might come as nice to have feature. Let me explain you my condition. We host web application where lot of DNS

Re: [Freeipa-users] User Roles and access in GUI

2013-04-16 Thread Petr Vobornik
On 04/16/2013 01:14 AM, Stephen Ingram wrote: On Mon, Apr 15, 2013 at 3:13 PM, Dmitri Pal d...@redhat.com wrote: On 04/15/2013 11:11 AM, Chandan Kumar wrote: I think controlling Visibility of tabs would be the best option, if possible, based on Roles as mentioned by Rob. As long as other

Re: [Freeipa-users] User Roles and access in GUI

2013-04-16 Thread Dmitri Pal
On 04/16/2013 03:38 AM, Martin Kosek wrote: On 04/16/2013 03:16 AM, Dmitri Pal wrote: On 04/15/2013 07:42 PM, Chandan Kumar wrote: I agree it won't be a security feature nor you are doing wrong by not adding it. However, it might come as nice to have feature. Let me explain you my condition.

Re: [Freeipa-users] User Roles and access in GUI

2013-04-16 Thread Martin Kosek
On 04/16/2013 04:25 PM, Dmitri Pal wrote: On 04/16/2013 03:38 AM, Martin Kosek wrote: On 04/16/2013 03:16 AM, Dmitri Pal wrote: On 04/15/2013 07:42 PM, Chandan Kumar wrote: I agree it won't be a security feature nor you are doing wrong by not adding it. However, it might come as nice to

Re: [Freeipa-users] User Roles and access in GUI

2013-04-15 Thread Dmitri Pal
On 04/12/2013 08:17 PM, Chandan Kumar wrote: Thanks for the response. The way we can turn off the anonymous bind in 389 Server. using nsslapd-allow-anonymous-access: off. Is there any way to limit the read access of user to only to the DNS entries? In that way I can create a user who

Re: [Freeipa-users] User Roles and access in GUI

2013-04-15 Thread Rob Crittenden
Dmitri Pal wrote: On 04/12/2013 08:17 PM, Chandan Kumar wrote: Thanks for the response. The way we can turn off the anonymous bind in 389 Server. using nsslapd-allow-anonymous-access: off. Is there any way to limit the read access of user to only to the DNS entries? In that way I can create

Re: [Freeipa-users] User Roles and access in GUI

2013-04-15 Thread Petr Spacek
On 15.4.2013 15:39, Rob Crittenden wrote: There is no easy way to do this. We start with granting all authenticated users read access to the tree with the exception of certain attributes (like passwords). You'd have to start by removing that, then one by one granting read access to the various

Re: [Freeipa-users] User Roles and access in GUI

2013-04-15 Thread Alexander Bokovoy
On Mon, 15 Apr 2013, Petr Spacek wrote: On 15.4.2013 15:39, Rob Crittenden wrote: There is no easy way to do this. We start with granting all authenticated users read access to the tree with the exception of certain attributes (like passwords). You'd have to start by removing that, then one by

Re: [Freeipa-users] User Roles and access in GUI

2013-04-15 Thread Dmitri Pal
On 04/15/2013 11:11 AM, Chandan Kumar wrote: I think controlling Visibility of tabs would be the best option, if possible, based on Roles as mentioned by Rob. As long as other entries are not visible in UI, even though they have read only access with command line, should be enough. It would

Re: [Freeipa-users] User Roles and access in GUI

2013-04-15 Thread Stephen Ingram
On Mon, Apr 15, 2013 at 3:13 PM, Dmitri Pal d...@redhat.com wrote: On 04/15/2013 11:11 AM, Chandan Kumar wrote: I think controlling Visibility of tabs would be the best option, if possible, based on Roles as mentioned by Rob. As long as other entries are not visible in UI, even though

Re: [Freeipa-users] User Roles and access in GUI

2013-04-15 Thread Dmitri Pal
On 04/15/2013 07:42 PM, Chandan Kumar wrote: I agree it won't be a security feature nor you are doing wrong by not adding it. However, it might come as nice to have feature. Let me explain you my condition. We host web application where lot of DNS entries (Public and Internal) are created

Re: [Freeipa-users] User Roles and access in GUI

2013-04-12 Thread Martin Kosek
On 04/12/2013 01:07 AM, Chandan Kumar wrote: Hello, I have a question regarding Uer Roles and Access in GUI. What I have found that irrespective of Role assigned to a user, he gets read only access across the directory. For example, I created one user say dnsadmin with only Roles

Re: [Freeipa-users] User Roles and access in GUI

2013-04-12 Thread Dmitri Pal
On 04/12/2013 02:23 AM, Martin Kosek wrote: On 04/12/2013 01:07 AM, Chandan Kumar wrote: Hello, I have a question regarding Uer Roles and Access in GUI. What I have found that irrespective of Role assigned to a user, he gets read only access across the directory. For example, I created

Re: [Freeipa-users] User Roles and access in GUI

2013-04-12 Thread Chandan Kumar
Thanks for the response. The way we can turn off the anonymous bind in 389 Server. using nsslapd-allow-anonymous-access: off. Is there any way to limit the read access of user to only to the DNS entries? In that way I can create a user who could/will be able to see/edit DNS entries only.