IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Make 'permission' the default bind type for managed permissions

Browse Source 
This reduces typing (or copy/pasting), and draws a bit of attention
to any non-default privileges (currently 'any' or 'anonymous').

Leaving the bindtype out by mistake isn't dangerous: by default
a permission is not granted to anyone, since it is not included in
any priviliges.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
This commit is contained in:
Petr Viktorin
2014-06-09 17:59:53 +02:00
parent 6acaf73b0c
commit 2f3cdba546
9 changed files with 1 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
ipalib/plugins/automember.py
View File

@@ -199,7 +199,6 @@ class automember(LDAPObject):
'ipapermlocation': DN(container_dn, api.env.basedn),
'ipapermtargetfilter': {'(objectclass=automemberdefinition)'},
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'permission',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'objectclass', 'cn', 'automemberscope', 'automemberfilter',
@@ -211,7 +210,6 @@ class automember(LDAPObject):
},
'System: Read Automember Rules': {
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'permission',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'cn', 'objectclass', 'automembertargetgroup', 'description',
@@ -225,7 +223,6 @@ class automember(LDAPObject):
'ipapermlocation': DN('cn=tasks', 'cn=config'),
'ipapermtarget': DN('cn=*', REBUILD_TASK_CONTAINER),
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'permission',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {'*'},
'default_privileges': {'Automember Task Administrator'},

2
ipalib/plugins/krbtpolicy.py
View File

@@ -90,7 +90,6 @@ class krbtpolicy(baseldap.LDAPObject):
'replaces_global_anonymous_aci': True,
'ipapermtargetfilter': ['(objectclass=krbticketpolicyaux)'],
'ipapermlocation': DN(container_dn, api.env.basedn),
'ipapermbindruletype': 'permission',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'krbdefaultencsalttypes', 'krbmaxrenewableage',
@@ -106,7 +105,6 @@ class krbtpolicy(baseldap.LDAPObject):
'replaces_global_anonymous_aci': True,
'ipapermlocation': DN(api.env.container_user, api.env.basedn),
'ipapermtargetfilter': ['(objectclass=krbticketpolicyaux)'],
'ipapermbindruletype': 'permission',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'krbmaxrenewableage', 'krbmaxticketlife',

2
ipalib/plugins/permission.py
View File

@@ -185,7 +185,6 @@ class permission(baseldap.LDAPObject):
managed_permissions = {
'System: Read Permissions': {
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'permission',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'businesscategory', 'cn', 'description', 'ipapermissiontype',
@@ -202,7 +201,6 @@ class permission(baseldap.LDAPObject):
'non_object': True,
'ipapermlocation': api.env.basedn,
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'permission',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {'aci'},
'default_privileges': {'RBAC Readers'},

1
ipalib/plugins/privilege.py
View File

@@ -67,7 +67,6 @@ class privilege(LDAPObject):
managed_permissions = {
'System: Read Privileges': {
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'permission',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'businesscategory', 'cn', 'description', 'member', 'memberof',

1
ipalib/plugins/pwpolicy.py
View File

@@ -87,7 +87,6 @@ class cosentry(LDAPObject):
managed_permissions = {
'System: Read Group Password Policy costemplate': {
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'permission',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'cn', 'cospriority', 'krbpwdpolicyreference', 'objectclass',

1
ipalib/plugins/role.py
View File

@@ -85,7 +85,6 @@ class role(LDAPObject):
managed_permissions = {
'System: Read Roles': {
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'permission',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'businesscategory', 'cn', 'description', 'member', 'memberof',

3
ipalib/plugins/sudorule.py
View File

@@ -150,7 +150,6 @@ class sudorule(LDAPObject):
},
},
'System: Add Sudo rule': {
'ipapermbindruletype': 'permission',
'ipapermright': {'add'},
'replaces': [
'(target = "ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Add Sudo rule";allow (add) groupdn = "ldap:///cn=Add Sudo rule,cn=permissions,cn=pbac,$SUFFIX";)',
@@ -158,7 +157,6 @@ class sudorule(LDAPObject):
'default_privileges': {'Sudo Administrator'},
},
'System: Delete Sudo rule': {
'ipapermbindruletype': 'permission',
'ipapermright': {'delete'},
'replaces': [
'(target = "ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Delete Sudo rule";allow (delete) groupdn = "ldap:///cn=Delete Sudo rule,cn=permissions,cn=pbac,$SUFFIX";)',
@@ -166,7 +164,6 @@ class sudorule(LDAPObject):
'default_privileges': {'Sudo Administrator'},
},
'System: Modify Sudo rule': {
'ipapermbindruletype': 'permission',
'ipapermright': {'write'},
'ipapermdefaultattr': {
'description', 'ipaenabledflag', 'usercategory',

9
ipalib/plugins/user.py
View File

@@ -310,7 +310,6 @@ class user(LDAPObject):
},
'System: Read User Kerberos Login Attributes': {
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'permission',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'krblastsuccessfulauth', 'krblastfailedauth',
@@ -334,13 +333,11 @@ class user(LDAPObject):
'non_object': True,
'ipapermlocation': UPG_DEFINITION_DN,
'ipapermtarget': UPG_DEFINITION_DN,
'ipapermbindruletype': 'permission',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {'*'},
'default_privileges': {'User Administrators'},
},
'System: Add Users': {
'ipapermbindruletype': 'permission',
'ipapermright': {'add'},
'replaces': [
'(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Add Users";allow (add) groupdn = "ldap:///cn=Add Users,cn=permissions,cn=pbac,$SUFFIX";)',
@@ -349,7 +346,6 @@ class user(LDAPObject):
},
'System: Add User to default group': {
'non_object': True,
'ipapermbindruletype': 'permission',
'ipapermright': {'write'},
'ipapermlocation': DN(api.env.container_group, api.env.basedn),
'ipapermtarget': DN('cn=ipausers', api.env.container_group,
@@ -361,7 +357,6 @@ class user(LDAPObject):
'default_privileges': {'User Administrators'},
},
'System: Change User password': {
'ipapermbindruletype': 'permission',
'ipapermright': {'write'},
'ipapermtargetfilter': [
'(objectclass=posixaccount)',
@@ -383,7 +378,6 @@ class user(LDAPObject):
},
},
'System: Manage User SSH Public Keys': {
'ipapermbindruletype': 'permission',
'ipapermright': {'write'},
'ipapermdefaultattr': {'ipasshpubkey'},
'replaces': [
@@ -392,7 +386,6 @@ class user(LDAPObject):
'default_privileges': {'User Administrators'},
},
'System: Modify Users': {
'ipapermbindruletype': 'permission',
'ipapermright': {'write'},
'ipapermdefaultattr': {
'businesscategory', 'carlicense', 'cn', 'description',
@@ -413,7 +406,6 @@ class user(LDAPObject):
},
},
'System: Remove Users': {
'ipapermbindruletype': 'permission',
'ipapermright': {'delete'},
'replaces': [
'(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Remove Users";allow (delete) groupdn = "ldap:///cn=Remove Users,cn=permissions,cn=pbac,$SUFFIX";)',
@@ -421,7 +413,6 @@ class user(LDAPObject):
'default_privileges': {'User Administrators'},
},
'System: Unlock User': {
'ipapermbindruletype': 'permission',
'ipapermright': {'write'},
'ipapermdefaultattr': {
'krblastadminunlock', 'krbloginfailedcount', 'nsaccountlock',

2
ipaserver/install/plugins/update_managed_permissions.py
View File

@@ -533,7 +533,7 @@ class update_managed_permissions(PostUpdate):
entry['ipapermtarget'] = ipapermtarget
# Attributes from template
bindruletype = template.pop('ipapermbindruletype')
bindruletype = template.pop('ipapermbindruletype', 'permission')
if is_new:
entry.single_value['ipapermbindruletype'] = bindruletype