IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Add managed read permissions to HBAC objects

Browse Source 
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
This commit is contained in:
Petr Viktorin
2014-03-26 15:33:49 +01:00
parent 218a261742
commit 39327dbb75
3 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
ipalib/plugins/hbacrule.py
View File

@@ -115,6 +115,7 @@ class hbacrule(LDAPObject):
object_name = _('HBAC rule')
object_name_plural = _('HBAC rules')
object_class = ['ipaassociation', 'ipahbacrule']
permission_filter_objectclasses = ['ipahbacrule']
default_attributes = [
'cn', 'ipaenabledflag',
'description', 'usercategory', 'hostcategory',
@@ -130,6 +131,20 @@ class hbacrule(LDAPObject):
'sourcehost': ['host', 'hostgroup'],
'memberservice': ['hbacsvc', 'hbacsvcgroup'],
}
managed_permissions = {
'System: Read HBAC Rules': {
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'all',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'accessruletype', 'accesstime', 'cn', 'description',
'externalhost', 'hostcategory', 'ipaenabledflag',
'ipauniqueid', 'memberhost', 'memberservice', 'memberuser',
'servicecategory', 'sourcehost', 'sourcehostcategory',
'usercategory', 'objectclass',
},
},
}
label = _('HBAC Rules')
label_singular = _('HBAC Rule')

11
ipalib/plugins/hbacsvc.py
View File

@@ -57,11 +57,22 @@ class hbacsvc(LDAPObject):
object_name = _('HBAC service')
object_name_plural = _('HBAC services')
object_class = [ 'ipaobject', 'ipahbacservice' ]
permission_filter_objectclasses = ['ipahbacservice']
default_attributes = ['cn', 'description', 'memberof']
uuid_attribute = 'ipauniqueid'
attribute_members = {
'memberof': ['hbacsvcgroup'],
}
managed_permissions = {
'System: Read HBAC Services': {
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'all',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'cn', 'description', 'ipauniqueid', 'memberof', 'objectclass',
},
},
}
label = _('HBAC Services')
label_singular = _('HBAC Service')

12
ipalib/plugins/hbacsvcgroup.py
View File

@@ -52,11 +52,23 @@ class hbacsvcgroup(LDAPObject):
object_name = _('HBAC service group')
object_name_plural = _('HBAC service groups')
object_class = ['ipaobject', 'ipahbacservicegroup']
permission_filter_objectclasses = ['ipahbacservicegroup']
default_attributes = [ 'cn', 'description', 'member' ]
uuid_attribute = 'ipauniqueid'
attribute_members = {
'member': ['hbacsvc'],
}
managed_permissions = {
'System: Read HBAC Service Groups': {
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'all',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'businesscategory', 'cn', 'description', 'ipauniqueid',
'member', 'o', 'objectclass', 'ou', 'owner', 'seealso',
},
},
}
label = _('HBAC Service Groups')
label_singular = _('HBAC Service Group')