IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-24 16:10:02 -06:00
Code Issues Packages Projects Releases Wiki Activity

Reorder privileges so that memberof for permissions are generated properly.

Browse Source 
The privilege was added after the permission causing the memberof to not
be generated.

Add a new task to regenerate memberof for existing PBAC to fix upgrades.

https://fedorahosted.org/freeipa/ticket/2058
https://fedorahosted.org/freeipa/ticket/2059
https://fedorahosted.org/freeipa/ticket/2060
https://fedorahosted.org/freeipa/ticket/2061
This commit is contained in:
Rob Crittenden 2011-12-08 10:04:09 +01:00 committed by Martin Kosek
parent 58e5610592
commit 373e9d1cf8
4 changed files with 34 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
install/updates/40-delegation.update
View File

@ -18,6 +18,12 @@ dn: $SUFFIX
add:aci: '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,$SUFFIX";)' add:aci: '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,$SUFFIX";)'
# Host-Based Access Control # Host-Based Access Control
dn: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX
default:objectClass: nestedgroup
default:objectClass: groupofnames
default:objectClass: top
default:cn: HBAC Administrator
default:description: HBAC Administrator
dn: cn=Add HBAC rule,cn=permissions,cn=pbac,$SUFFIX dn: cn=Add HBAC rule,cn=permissions,cn=pbac,$SUFFIX
default:objectClass: groupofnames default:objectClass: groupofnames
@ -82,13 +88,6 @@ default:objectClass: top
default:cn: Manage HBAC service group membership default:cn: Manage HBAC service group membership
default:member: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX default:member: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX
dn: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX
default:objectClass: nestedgroup
default:objectClass: groupofnames
default:objectClass: top
default:cn: HBAC Administrator
default:description: HBAC Administrator
dn: $SUFFIX dn: $SUFFIX
add:aci: '(target = "ldap:///ipauniqueid=*,cn=hbac,$SUFFIX")(version 3.0;acl "permission:Add HBAC rule";allow (add) groupdn = "ldap:///cn=Add HBAC rule,cn=permissions,cn=pbac,$SUFFIX";)' add:aci: '(target = "ldap:///ipauniqueid=*,cn=hbac,$SUFFIX")(version 3.0;acl "permission:Add HBAC rule";allow (add) groupdn = "ldap:///cn=Add HBAC rule,cn=permissions,cn=pbac,$SUFFIX";)'
add:aci: '(target = "ldap:///ipauniqueid=*,cn=hbac,$SUFFIX")(version 3.0;acl "permission:Delete HBAC rule";allow (delete) groupdn = "ldap:///cn=Delete HBAC rule,cn=permissions,cn=pbac,$SUFFIX";)' add:aci: '(target = "ldap:///ipauniqueid=*,cn=hbac,$SUFFIX")(version 3.0;acl "permission:Delete HBAC rule";allow (delete) groupdn = "ldap:///cn=Delete HBAC rule,cn=permissions,cn=pbac,$SUFFIX";)'
@ -102,6 +101,13 @@ add:aci: '(targetattr = "member")(target = "ldap:///cn=*,cn=hbacservicegroups,cn
# SUDO # SUDO
dn: cn=Sudo Administrator,cn=privileges,cn=pbac,$SUFFIX
default:objectClass: nestedgroup
default:objectClass: groupofnames
default:objectClass: top
default:cn: Sudo Administrator
default:description: Sudo Administrator
dn: cn=Add Sudo rule,cn=permissions,cn=pbac,$SUFFIX dn: cn=Add Sudo rule,cn=permissions,cn=pbac,$SUFFIX
default:objectClass: groupofnames default:objectClass: groupofnames
default:objectClass: ipapermission default:objectClass: ipapermission
@ -165,13 +171,6 @@ default:objectClass: top
default:cn: Manage Sudo command group membership default:cn: Manage Sudo command group membership
default:member: cn=Sudo Administrator,cn=privileges,cn=pbac,$SUFFIX default:member: cn=Sudo Administrator,cn=privileges,cn=pbac,$SUFFIX
dn: cn=Sudo Administrator,cn=privileges,cn=pbac,$SUFFIX
default:objectClass: nestedgroup
default:objectClass: groupofnames
default:objectClass: top
default:cn: Sudo Administrator
default:description: Sudo Administrator
dn: $SUFFIX dn: $SUFFIX
add:aci: '(target = "ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Add Sudo rule";allow (add) groupdn = "ldap:///cn=Add Sudo rule,cn=permissions,cn=pbac,$SUFFIX";)' add:aci: '(target = "ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Add Sudo rule";allow (add) groupdn = "ldap:///cn=Add Sudo rule,cn=permissions,cn=pbac,$SUFFIX";)'
add:aci: '(target = "ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Delete Sudo rule";allow (delete) groupdn = "ldap:///cn=Delete Sudo rule,cn=permissions,cn=pbac,$SUFFIX";)' add:aci: '(target = "ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Delete Sudo rule";allow (delete) groupdn = "ldap:///cn=Delete Sudo rule,cn=permissions,cn=pbac,$SUFFIX";)'
@ -184,6 +183,13 @@ add:aci: '(target = "ldap:///cn=*,cn=sudocmdgroups,cn=sudo,$SUFFIX")(version 3.0
add:aci: '(targetattr = "member")(target = "ldap:///cn=*,cn=sudocmdgroups,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Manage Sudo command group membership";allow (write) groupdn = "ldap:///cn=Manage Sudo command group membership,cn=permissions,cn=pbac,$SUFFIX";)' add:aci: '(targetattr = "member")(target = "ldap:///cn=*,cn=sudocmdgroups,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Manage Sudo command group membership";allow (write) groupdn = "ldap:///cn=Manage Sudo command group membership,cn=permissions,cn=pbac,$SUFFIX";)'
# Password Policy # Password Policy
dn: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX
default:objectClass: nestedgroup
default:objectClass: groupofnames
default:objectClass: top
default:cn: Password Policy Administrator
default:description: Password Policy Administrator
dn: cn=Add Group Password Policy costemplate,cn=permissions,cn=pbac,$SUFFIX dn: cn=Add Group Password Policy costemplate,cn=permissions,cn=pbac,$SUFFIX
default:objectClass: groupofnames default:objectClass: groupofnames
default:objectClass: ipapermission default:objectClass: ipapermission
@ -226,13 +232,6 @@ default:objectClass: top
default:cn: Modify Group Password Policy default:cn: Modify Group Password Policy
default:member: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX default:member: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX
dn: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX
default:objectClass: nestedgroup
default:objectClass: groupofnames
default:objectClass: top
default:cn: Password Policy Administrator
default:description: Password Policy Administrator
dn: $SUFFIX dn: $SUFFIX
add:aci: '(target = "ldap:///cn=*,cn=costemplates,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Add Group Password Policy costemplate";allow (add) groupdn = "ldap:///cn=Add Group Password Policy costemplate,cn=permissions,cn=pbac,$SUFFIX";)' add:aci: '(target = "ldap:///cn=*,cn=costemplates,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Add Group Password Policy costemplate";allow (add) groupdn = "ldap:///cn=Add Group Password Policy costemplate,cn=permissions,cn=pbac,$SUFFIX";)'
add:aci: '(target = "ldap:///cn=*,cn=costemplates,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Delete Group Password Policy costemplate";allow (delete) groupdn = "ldap:///cn=Delete Group Password Policy costemplate,cn=permissions,cn=pbac,$SUFFIX";)' add:aci: '(target = "ldap:///cn=*,cn=costemplates,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Delete Group Password Policy costemplate";allow (delete) groupdn = "ldap:///cn=Delete Group Password Policy costemplate,cn=permissions,cn=pbac,$SUFFIX";)'

3
install/updates/45-roles.update
View File

@ -21,6 +21,9 @@ default:cn: Modify Group membership
default:description: Modify Group membership default:description: Modify Group membership
default:member: cn=helpdesk,cn=roles,cn=accounts,$SUFFIX default:member: cn=helpdesk,cn=roles,cn=accounts,$SUFFIX
dn: cn=Modify Group membership,cn=permissions,cn=pbac,$SUFFIX
add:member: 'cn=Modify Group membership,cn=privileges,cn=pbac,$SUFFIX'
dn: cn=User Administrator,cn=roles,cn=accounts,$SUFFIX dn: cn=User Administrator,cn=roles,cn=accounts,$SUFFIX
default:objectClass: groupofnames default:objectClass: groupofnames
default:objectClass: nestedgroup default:objectClass: nestedgroup

10
install/updates/55-pbacmemberof.update Normal file
View File

@ -0,0 +1,10 @@
#
# This needs to come later in the cycle otherwise the DN sorting is going
# to cause it to execute before the member attributes are added
dn: cn=Update PBAC memberOf $TIME, cn=memberof task, cn=tasks, cn=config
add: objectClass: top
add: objectClass: extensibleObject
add: cn: IPA PBAC memberOf $TIME
add: basedn: 'cn=privileges,cn=pbac,$SUFFIX'
add: filter: (objectclass=*)
add: ttl: 10

1
install/updates/Makefile.am
View File

@ -26,6 +26,7 @@ app_DATA = \
50-groupuuid.update \ 50-groupuuid.update \
50-hbacservice.update \ 50-hbacservice.update \
50-nis.update \ 50-nis.update \
55-pbacmemberof.update \
$(NULL) $(NULL)
EXTRA_DIST = \ EXTRA_DIST = \