mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-02-25 18:55:28 -06:00
Add permissions for certificate store.
Part of https://fedorahosted.org/freeipa/ticket/3259 Part of https://fedorahosted.org/freeipa/ticket/3520 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This commit is contained in:
Jan Cholasta
Petr Viktorin
parent
fd80cc1c59
commit
586373cf07
10
ACI.txt
10
ACI.txt
@ -248,14 +248,22 @@ dn: cn=users,cn=accounts,dc=ipa,dc=example
|
||||
aci: (targetattr = "krblastadminunlock || krbloginfailedcount || nsaccountlock")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Unlock User";allow (write) groupdn = "ldap:///cn=System: Unlock User,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=ca_renewal,cn=ipa,cn=etc,dc=ipa,dc=example
|
||||
aci: (target = "ldap:///cn=caSigningCert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=ipa,dc=example")(targetfilter = "(objectclass=pkiuser)")(version 3.0;acl "permission:System: Add CA Certificate For Renewal";allow (add) groupdn = "ldap:///cn=System: Add CA Certificate For Renewal,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=certificates,cn=ipa,cn=etc,dc=ipa,dc=example
|
||||
aci: (targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Add Certificate Store Entry";allow (add) groupdn = "ldap:///cn=System: Add Certificate Store Entry,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=CAcert,cn=ipa,cn=etc,dc=ipa,dc=example
|
||||
aci: (targetattr = "cacertificate")(targetfilter = "(objectclass=pkica)")(version 3.0;acl "permission:System: Modify CA Certificate";allow (write) groupdn = "ldap:///cn=System: Modify CA Certificate,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=ca_renewal,cn=ipa,cn=etc,dc=ipa,dc=example
|
||||
aci: (targetattr = "usercertificate")(target = "ldap:///cn=caSigningCert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=ipa,dc=example")(targetfilter = "(objectclass=pkiuser)")(version 3.0;acl "permission:System: Modify CA Certificate For Renewal";allow (write) groupdn = "ldap:///cn=System: Modify CA Certificate For Renewal,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=certificates,cn=ipa,cn=etc,dc=ipa,dc=example
|
||||
aci: (targetattr = "cacertificate || ipacertissuerserial || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Modify Certificate Store Entry";allow (write) groupdn = "ldap:///cn=System: Modify Certificate Store Entry,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=etc,dc=ipa,dc=example
|
||||
aci: (targetattr = "cn || ipantdomainguid || ipantfallbackprimarygroup || ipantflatname || ipantsecurityidentifier || objectclass")(target = "ldap:///cn=ad,cn=etc,dc=ipa,dc=example")(targetfilter = "(objectclass=ipantdomainattrs)")(version 3.0;acl "permission:System: Read AD Domains";allow (compare,read,search) userdn = "ldap:///all";)
|
||||
dn: cn=CAcert,cn=ipa,cn=etc,dc=ipa,dc=example
|
||||
aci: (targetattr = "authorityrevocationlist || cacertificate || certificaterevocationlist || cn || crosscertificatepair || objectclass")(targetfilter = "(objectclass=pkica)")(version 3.0;acl "permission:System: Read CA Certificate";allow (compare,read,search) userdn = "ldap:///anyone";)
|
||||
dn: cn=ca_renewal,cn=ipa,cn=etc,dc=ipa,dc=example
|
||||
aci: (targetattr = "cn || objectclass || usercertificate")(targetfilter = "(objectclass=pkiuser)")(version 3.0;acl "permission:System: Read CA Renewal Information";allow (compare,read,search) userdn = "ldap:///all";)
|
||||
dn: cn=certificates,cn=ipa,cn=etc,dc=ipa,dc=example
|
||||
aci: (targetattr = "cacertificate || cn || ipacertissuerserial || ipacertsubject || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage || ipapublickey || objectclass")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Read Certificate Store Entries";allow (compare,read,search) userdn = "ldap:///anyone";)
|
||||
dn: cn=dna,cn=ipa,cn=etc,dc=ipa,dc=example
|
||||
aci: (targetattr = "cn || dnahostname || dnaportnum || dnaremainingvalues || dnaremotebindmethod || dnaremoteconnprotocol || dnasecureportnum || objectclass")(targetfilter = "(objectclass=dnasharedconfig)")(version 3.0;acl "permission:System: Read DNA Configuration";allow (compare,read,search) userdn = "ldap:///all";)
|
||||
dn: cn=masters,cn=ipa,cn=etc,dc=ipa,dc=example
|
||||
@ -264,3 +272,5 @@ dn: cn=config
|
||||
aci: (targetattr = "cn || description || nsds50ruv || nsds5beginreplicarefresh || nsds5debugreplicatimeout || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicabindmethod || nsds5replicabusywaittime || nsds5replicachangecount || nsds5replicachangessentsincestartup || nsds5replicacleanruv || nsds5replicacleanruvnotified || nsds5replicacredentials || nsds5replicaenabled || nsds5replicahost || nsds5replicaid || nsds5replicalastinitend || nsds5replicalastinitstart || nsds5replicalastinitstatus || nsds5replicalastupdateend || nsds5replicalastupdatestart || nsds5replicalastupdatestatus || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaport || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicasessionpausetime || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || nsds5replicatimeout || nsds5replicatombstonepurgeinterval || nsds5replicatransportinfo || nsds5replicatype || nsds5replicaupdateinprogress || nsds5replicaupdateschedule || nsds5task || nsds7directoryreplicasubtree || nsds7dirsynccookie || nsds7newwingroupsyncenabled || nsds7newwinusersyncenabled || nsds7windowsdomain || nsds7windowsreplicasubtree || nsruvreplicalastmodified || nsstate || objectclass || onewaysync || winsyncdirectoryfilter || winsyncinterval || winsyncmoveaction || winsyncsubtreepair || winsyncwindowsfilter")(targetfilter = "(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0;acl "permission:System: Read Replication Agreements";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Replication Agreements,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=replication,cn=etc,dc=ipa,dc=example
|
||||
aci: (targetattr = "cn || nsds5flags || nsds5replicaabortcleanruv || nsds5replicaautoreferral || nsds5replicabackoffmax || nsds5replicabackoffmin || nsds5replicabinddn || nsds5replicachangecount || nsds5replicacleanruv || nsds5replicaid || nsds5replicalegacyconsumer || nsds5replicaname || nsds5replicaprotocoltimeout || nsds5replicapurgedelay || nsds5replicareferral || nsds5replicaroot || nsds5replicatombstonepurgeinterval || nsds5replicatype || nsds5task || nsstate || objectclass")(targetfilter = "(objectclass=nsds5replica)")(version 3.0;acl "permission:System: Read Replication Information";allow (compare,read,search) userdn = "ldap:///all";)
|
||||
dn: cn=certificates,cn=ipa,cn=etc,dc=ipa,dc=example
|
||||
aci: (targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Remove Certificate Store Entry";allow (delete) groupdn = "ldap:///cn=System: Remove Certificate Store Entry,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
|
||||
@ -74,6 +74,9 @@ add: member: 'cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX'
|
||||
dn: cn=ipa,cn=etc,$SUFFIX
|
||||
add:aci:'(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,$SUFFIX")(targetattr = cACertificate)(version 3.0; acl "Modify CA Certificate"; allow (write) userdn = "ldap:///fqdn=$FQDN,cn=computers,cn=accounts,$SUFFIX";)'
|
||||
|
||||
dn: cn=certificates,cn=ipa,cn=etc,$SUFFIX
|
||||
add:aci:'(targetfilter = "(&(objectClass=ipaCertificate)(ipaConfigString=ipaCA))")(targetattr = "ipaCertIssuerSerial || cACertificate")(version 3.0; acl "Modify CA Certificate Store Entry"; allow (write) userdn = "ldap:///fqdn=$FQDN,cn=computers,cn=accounts,$SUFFIX";)'
|
||||
|
||||
# Automember tasks
|
||||
dn: cn=Automember Task Administrator,cn=privileges,cn=pbac,$SUFFIX
|
||||
default:objectClass: nestedgroup
|
||||
|
||||
@ -163,6 +163,52 @@ NONOBJECT_PERMISSIONS = {
|
||||
'authorityrevocationlist', 'crosscertificatepair',
|
||||
},
|
||||
},
|
||||
'System: Modify CA Certificate': {
|
||||
'ipapermlocation': DN('cn=CAcert,cn=ipa,cn=etc', api.env.basedn),
|
||||
'ipapermtargetfilter': {'(objectclass=pkica)'},
|
||||
'ipapermbindruletype': 'permission',
|
||||
'ipapermright': {'write'},
|
||||
'ipapermdefaultattr': {
|
||||
'cacertificate',
|
||||
},
|
||||
'default_privileges': {'Certificate Administrators'},
|
||||
},
|
||||
'System: Read Certificate Store Entries': {
|
||||
'ipapermlocation': DN('cn=certificates,cn=ipa,cn=etc', api.env.basedn),
|
||||
'ipapermtargetfilter': {'(objectclass=ipacertificate)'},
|
||||
'ipapermbindruletype': 'anonymous',
|
||||
'ipapermright': {'read', 'search', 'compare'},
|
||||
'ipapermdefaultattr': {
|
||||
'cn', 'objectclass', 'ipacertsubject', 'ipacertissuerserial',
|
||||
'ipapublickey', 'ipaconfigstring', 'cacertificate', 'ipakeytrust',
|
||||
'ipakeyusage', 'ipakeyextusage',
|
||||
},
|
||||
},
|
||||
'System: Add Certificate Store Entry': {
|
||||
'ipapermlocation': DN('cn=certificates,cn=ipa,cn=etc', api.env.basedn),
|
||||
'ipapermtargetfilter': {'(objectclass=ipacertificate)'},
|
||||
'ipapermbindruletype': 'permission',
|
||||
'ipapermright': {'add'},
|
||||
'default_privileges': {'Certificate Administrators'},
|
||||
},
|
||||
'System: Modify Certificate Store Entry': {
|
||||
'ipapermlocation': DN('cn=certificates,cn=ipa,cn=etc', api.env.basedn),
|
||||
'ipapermtargetfilter': {'(objectclass=ipacertificate)'},
|
||||
'ipapermbindruletype': 'permission',
|
||||
'ipapermright': {'write'},
|
||||
'ipapermdefaultattr': {
|
||||
'ipacertissuerserial', 'ipaconfigstring', 'cacertificate',
|
||||
'ipakeytrust', 'ipakeyusage', 'ipakeyextusage',
|
||||
},
|
||||
'default_privileges': {'Certificate Administrators'},
|
||||
},
|
||||
'System: Remove Certificate Store Entry': {
|
||||
'ipapermlocation': DN('cn=certificates,cn=ipa,cn=etc', api.env.basedn),
|
||||
'ipapermtargetfilter': {'(objectclass=ipacertificate)'},
|
||||
'ipapermbindruletype': 'permission',
|
||||
'ipapermright': {'delete'},
|
||||
'default_privileges': {'Certificate Administrators'},
|
||||
},
|
||||
'System: Read Replication Information': {
|
||||
'replaces_global_anonymous_aci': True,
|
||||
'ipapermlocation': DN('cn=replication,cn=etc', api.env.basedn),
|
||||
|
||||
@ -1282,6 +1282,36 @@ class ReplicationManager(object):
|
||||
elif not err:
|
||||
err = e
|
||||
|
||||
try:
|
||||
entry = self.conn.get_entry(
|
||||
DN(('cn', 'certificates'), ('cn', 'ipa'), ('cn', 'etc'),
|
||||
self.suffix),
|
||||
['aci'])
|
||||
|
||||
sub = {'suffix': self.suffix, 'fqdn': replica}
|
||||
try:
|
||||
entry.raw['aci'].remove(
|
||||
'(targetfilter = "(&(objectClass=ipaCertificate)'
|
||||
'(ipaConfigString=ipaCA))")(targetattr = '
|
||||
'"ipaCertIssuerSerial || cACertificate")(version 3.0; acl '
|
||||
'"Modify CA Certificate Store Entry"; allow (write) '
|
||||
'userdn = "ldap:///fqdn=%(fqdn)s,cn=computers,cn=accounts,'
|
||||
'%(suffix)s";)' % sub)
|
||||
except ValueError:
|
||||
pass
|
||||
|
||||
try:
|
||||
self.conn.update_entry(entry)
|
||||
except errors.EmptyModlist:
|
||||
pass
|
||||
except errors.NotFound:
|
||||
pass
|
||||
except Exception, e:
|
||||
if not force:
|
||||
raise e
|
||||
elif not err:
|
||||
err = e
|
||||
|
||||
try:
|
||||
basedn = DN(('cn', 'etc'), self.suffix)
|
||||
filter = '(dnaHostname=%s)' % replica
|
||||
|
||||
Loading…
Reference in New Issue
Block a user