2010-12-01 10:23:52 -06:00
|
|
|
# Authors:
|
|
|
|
# Rob Crittenden <rcritten@redhat.com>
|
|
|
|
# Pavel Zuna <pzuna@redhat.com>
|
|
|
|
#
|
|
|
|
# Copyright (C) 2009 Red Hat
|
|
|
|
# see file 'COPYING' for use and warranty information
|
|
|
|
#
|
2010-12-09 06:59:11 -06:00
|
|
|
# This program is free software; you can redistribute it and/or modify
|
|
|
|
# it under the terms of the GNU General Public License as published by
|
|
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
|
|
# (at your option) any later version.
|
2010-12-01 10:23:52 -06:00
|
|
|
#
|
|
|
|
# This program is distributed in the hope that it will be useful,
|
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
#
|
|
|
|
# You should have received a copy of the GNU General Public License
|
2010-12-09 06:59:11 -06:00
|
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
2011-08-24 21:48:30 -05:00
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
from ipalib.plugable import Registry
|
2016-04-20 08:41:34 -05:00
|
|
|
from .baseldap import (
|
2015-12-16 12:04:20 -06:00
|
|
|
LDAPObject,
|
|
|
|
LDAPCreate,
|
|
|
|
LDAPDelete,
|
|
|
|
LDAPUpdate,
|
|
|
|
LDAPSearch,
|
|
|
|
LDAPRetrieve,
|
|
|
|
LDAPAddMember,
|
|
|
|
LDAPRemoveMember,
|
|
|
|
LDAPAddReverseMember,
|
|
|
|
LDAPRemoveReverseMember)
|
2011-08-24 21:48:30 -05:00
|
|
|
from ipalib import api, Str, _, ngettext
|
2015-12-16 12:04:20 -06:00
|
|
|
from ipalib import output
|
2011-08-24 21:48:30 -05:00
|
|
|
|
|
|
|
__doc__ = _("""
|
2010-12-01 10:23:52 -06:00
|
|
|
Roles
|
|
|
|
|
|
|
|
A role is used for fine-grained delegation. A permission grants the ability
|
|
|
|
to perform given low-level tasks (add a user, modify a group, etc.). A
|
|
|
|
privilege combines one or more permissions into a higher-level abstraction
|
|
|
|
such as useradmin. A useradmin would be able to add, delete and modify users.
|
|
|
|
|
|
|
|
Privileges are assigned to Roles.
|
|
|
|
|
|
|
|
Users, groups, hosts and hostgroups may be members of a Role.
|
|
|
|
|
|
|
|
Roles can not contain other roles.
|
|
|
|
|
|
|
|
EXAMPLES:
|
|
|
|
|
|
|
|
Add a new role:
|
|
|
|
ipa role-add --desc="Junior-level admin" junioradmin
|
|
|
|
|
|
|
|
Add some privileges to this role:
|
|
|
|
ipa role-add-privilege --privileges=addusers junioradmin
|
|
|
|
ipa role-add-privilege --privileges=change_password junioradmin
|
2012-01-04 20:04:56 -06:00
|
|
|
ipa role-add-privilege --privileges=add_user_to_default_group junioradmin
|
2010-12-01 10:23:52 -06:00
|
|
|
|
|
|
|
Add a group of users to this role:
|
|
|
|
ipa group-add --desc="User admins" useradmins
|
|
|
|
ipa role-add-member --groups=useradmins junioradmin
|
|
|
|
|
|
|
|
Display information about a role:
|
|
|
|
ipa role-show junioradmin
|
|
|
|
|
2012-01-04 20:04:56 -06:00
|
|
|
The result of this is that any users in the group 'junioradmin' can
|
2010-12-01 10:23:52 -06:00
|
|
|
add users, reset passwords or add a user to the default IPA user group.
|
2011-08-24 21:48:30 -05:00
|
|
|
""")
|
2010-12-01 10:23:52 -06:00
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
register = Registry()
|
|
|
|
|
|
|
|
@register()
|
2010-12-01 10:23:52 -06:00
|
|
|
class role(LDAPObject):
|
|
|
|
"""
|
|
|
|
Role object.
|
|
|
|
"""
|
|
|
|
container_dn = api.env.container_rolegroup
|
2011-07-12 11:01:25 -05:00
|
|
|
object_name = _('role')
|
|
|
|
object_name_plural = _('roles')
|
2010-12-01 10:23:52 -06:00
|
|
|
object_class = ['groupofnames', 'nestedgroup']
|
2014-03-26 11:11:23 -05:00
|
|
|
permission_filter_objectclasses = ['groupofnames']
|
2015-03-31 03:59:37 -05:00
|
|
|
default_attributes = ['cn', 'description', 'member', 'memberof']
|
|
|
|
# Role could have a lot of indirect members, but they are not in
|
|
|
|
# attribute_members therefore they don't have to be in default_attributes
|
|
|
|
# 'memberindirect', 'memberofindirect',
|
|
|
|
|
2010-12-01 10:23:52 -06:00
|
|
|
attribute_members = {
|
2014-08-18 09:49:40 -05:00
|
|
|
'member': ['user', 'group', 'host', 'hostgroup', 'service'],
|
2011-03-14 13:31:56 -05:00
|
|
|
'memberof': ['privilege'],
|
2010-12-01 10:23:52 -06:00
|
|
|
}
|
|
|
|
reverse_members = {
|
|
|
|
'member': ['privilege'],
|
|
|
|
}
|
2012-02-29 12:31:20 -06:00
|
|
|
rdn_is_primary_key = True
|
2014-03-26 11:11:23 -05:00
|
|
|
managed_permissions = {
|
|
|
|
'System: Read Roles': {
|
|
|
|
'replaces_global_anonymous_aci': True,
|
|
|
|
'ipapermright': {'read', 'search', 'compare'},
|
|
|
|
'ipapermdefaultattr': {
|
|
|
|
'businesscategory', 'cn', 'description', 'member', 'memberof',
|
2014-06-10 05:31:29 -05:00
|
|
|
'o', 'objectclass', 'ou', 'owner', 'seealso', 'memberuser',
|
|
|
|
'memberhost',
|
2014-03-26 11:11:23 -05:00
|
|
|
},
|
|
|
|
'default_privileges': {'RBAC Readers'},
|
|
|
|
},
|
2014-06-04 10:39:10 -05:00
|
|
|
'System: Add Roles': {
|
|
|
|
'ipapermright': {'add'},
|
|
|
|
'replaces': [
|
|
|
|
'(target = "ldap:///cn=*,cn=roles,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Add Roles";allow (add) groupdn = "ldap:///cn=Add Roles,cn=permissions,cn=pbac,$SUFFIX";)',
|
|
|
|
],
|
|
|
|
'default_privileges': {'Delegation Administrator'},
|
|
|
|
},
|
|
|
|
'System: Modify Role Membership': {
|
|
|
|
'ipapermright': {'write'},
|
|
|
|
'ipapermdefaultattr': {'member'},
|
|
|
|
'replaces': [
|
|
|
|
'(targetattr = "member")(target = "ldap:///cn=*,cn=roles,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Role membership";allow (write) groupdn = "ldap:///cn=Modify Role membership,cn=permissions,cn=pbac,$SUFFIX";)',
|
|
|
|
],
|
|
|
|
'default_privileges': {'Delegation Administrator'},
|
|
|
|
},
|
|
|
|
'System: Modify Roles': {
|
|
|
|
'ipapermright': {'write'},
|
|
|
|
'ipapermdefaultattr': {'cn', 'description'},
|
|
|
|
'replaces': [
|
|
|
|
'(targetattr = "cn || description")(target = "ldap:///cn=*,cn=roles,cn=accounts,$SUFFIX")(version 3.0; acl "permission:Modify Roles";allow (write) groupdn = "ldap:///cn=Modify Roles,cn=permissions,cn=pbac,$SUFFIX";)',
|
|
|
|
],
|
|
|
|
'default_privileges': {'Delegation Administrator'},
|
|
|
|
},
|
|
|
|
'System: Remove Roles': {
|
|
|
|
'ipapermright': {'delete'},
|
|
|
|
'replaces': [
|
|
|
|
'(target = "ldap:///cn=*,cn=roles,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Remove Roles";allow (delete) groupdn = "ldap:///cn=Remove Roles,cn=permissions,cn=pbac,$SUFFIX";)',
|
|
|
|
],
|
|
|
|
'default_privileges': {'Delegation Administrator'},
|
|
|
|
},
|
2014-03-26 11:11:23 -05:00
|
|
|
}
|
2010-12-01 10:23:52 -06:00
|
|
|
|
2011-06-24 11:39:48 -05:00
|
|
|
label = _('Roles')
|
2011-07-13 21:10:47 -05:00
|
|
|
label_singular = _('Role')
|
2010-12-01 10:23:52 -06:00
|
|
|
|
|
|
|
takes_params = (
|
|
|
|
Str('cn',
|
|
|
|
cli_name='name',
|
|
|
|
label=_('Role name'),
|
|
|
|
primary_key=True,
|
|
|
|
),
|
2014-09-26 01:54:28 -05:00
|
|
|
Str('description?',
|
2010-12-01 10:23:52 -06:00
|
|
|
cli_name='desc',
|
|
|
|
label=_('Description'),
|
|
|
|
doc=_('A description of this role-group'),
|
|
|
|
),
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
@register()
|
2010-12-01 10:23:52 -06:00
|
|
|
class role_add(LDAPCreate):
|
2011-08-24 21:48:30 -05:00
|
|
|
__doc__ = _('Add a new role.')
|
2010-12-01 10:23:52 -06:00
|
|
|
|
|
|
|
msg_summary = _('Added role "%(value)s"')
|
|
|
|
|
|
|
|
|
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
@register()
|
2010-12-01 10:23:52 -06:00
|
|
|
class role_del(LDAPDelete):
|
2011-08-24 21:48:30 -05:00
|
|
|
__doc__ = _('Delete a role.')
|
2010-12-01 10:23:52 -06:00
|
|
|
|
|
|
|
msg_summary = _('Deleted role "%(value)s"')
|
|
|
|
|
|
|
|
|
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
@register()
|
2010-12-01 10:23:52 -06:00
|
|
|
class role_mod(LDAPUpdate):
|
2011-08-24 21:48:30 -05:00
|
|
|
__doc__ = _('Modify a role.')
|
2010-12-01 10:23:52 -06:00
|
|
|
|
|
|
|
msg_summary = _('Modified role "%(value)s"')
|
|
|
|
|
|
|
|
|
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
@register()
|
2010-12-01 10:23:52 -06:00
|
|
|
class role_find(LDAPSearch):
|
2011-08-24 21:48:30 -05:00
|
|
|
__doc__ = _('Search for roles.')
|
2010-12-01 10:23:52 -06:00
|
|
|
|
|
|
|
msg_summary = ngettext(
|
2011-02-23 15:47:49 -06:00
|
|
|
'%(count)d role matched', '%(count)d roles matched', 0
|
2010-12-01 10:23:52 -06:00
|
|
|
)
|
|
|
|
|
|
|
|
|
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
@register()
|
2010-12-01 10:23:52 -06:00
|
|
|
class role_show(LDAPRetrieve):
|
2011-08-24 21:48:30 -05:00
|
|
|
__doc__ = _('Display information about a role.')
|
2010-12-01 10:23:52 -06:00
|
|
|
|
|
|
|
|
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
@register()
|
2010-12-01 10:23:52 -06:00
|
|
|
class role_add_member(LDAPAddMember):
|
2011-08-24 21:48:30 -05:00
|
|
|
__doc__ = _('Add members to a role.')
|
2010-12-01 10:23:52 -06:00
|
|
|
|
|
|
|
|
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
@register()
|
2010-12-01 10:23:52 -06:00
|
|
|
class role_remove_member(LDAPRemoveMember):
|
2011-08-24 21:48:30 -05:00
|
|
|
__doc__ = _('Remove members from a role.')
|
2010-12-01 10:23:52 -06:00
|
|
|
|
|
|
|
|
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
@register()
|
2010-12-01 10:23:52 -06:00
|
|
|
class role_add_privilege(LDAPAddReverseMember):
|
2011-08-24 21:48:30 -05:00
|
|
|
__doc__ = _('Add privileges to a role.')
|
|
|
|
|
2010-12-01 10:23:52 -06:00
|
|
|
show_command = 'role_show'
|
|
|
|
member_command = 'privilege_add_member'
|
|
|
|
reverse_attr = 'privilege'
|
|
|
|
member_attr = 'role'
|
|
|
|
|
|
|
|
has_output = (
|
|
|
|
output.Entry('result'),
|
|
|
|
output.Output('failed',
|
|
|
|
type=dict,
|
|
|
|
doc=_('Members that could not be added'),
|
|
|
|
),
|
|
|
|
output.Output('completed',
|
|
|
|
type=int,
|
|
|
|
doc=_('Number of privileges added'),
|
|
|
|
),
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
@register()
|
2010-12-01 10:23:52 -06:00
|
|
|
class role_remove_privilege(LDAPRemoveReverseMember):
|
2011-08-24 21:48:30 -05:00
|
|
|
__doc__ = _('Remove privileges from a role.')
|
|
|
|
|
2010-12-01 10:23:52 -06:00
|
|
|
show_command = 'role_show'
|
|
|
|
member_command = 'privilege_remove_member'
|
|
|
|
reverse_attr = 'privilege'
|
|
|
|
member_attr = 'role'
|
|
|
|
|
|
|
|
has_output = (
|
|
|
|
output.Entry('result'),
|
|
|
|
output.Output('failed',
|
|
|
|
type=dict,
|
|
|
|
doc=_('Members that could not be added'),
|
|
|
|
),
|
|
|
|
output.Output('completed',
|
|
|
|
type=int,
|
|
|
|
doc=_('Number of privileges removed'),
|
|
|
|
),
|
|
|
|
)
|