IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Remove virtual attributes before rolling back a permission

Browse Source 
On a failed permission update if the generated ACI is
invalid then the updated permission is rolled back.

Add the virtual relationship attributes to list of attributes
to be ignored when rolling back the entry.

This relies on the current order in the LDAPObject
relationships field where member and memberof are the first
two values.

https://pagure.io/freeipa/issue/8646

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
This commit is contained in:
Rob Crittenden
2021-01-08 17:05:10 -05:00
committed by Florence Blanc-Renaud
parent 3e8e836544
commit 59d6c4da73
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
ipaserver/plugins/permission.py
View File

@@ -1236,8 +1236,15 @@ class permission_mod(baseldap.LDAPUpdate):
else: else:
self.obj.update_aci(entry, old_entry.single_value['cn']) self.obj.update_aci(entry, old_entry.single_value['cn'])
except Exception: except Exception:
# Don't revert attribute which doesn't exist in LDAP # Don't revert attributes which don't exist in LDAP
entry.pop('attributelevelrights', None) entry.pop('attributelevelrights', None)
for attr in list(
filter(
lambda x: x not in ["member", "memberof"],
[*self.obj.relationships],
)
):
entry.pop(attr, None)
logger.error('Error updating ACI: %s', traceback.format_exc()) logger.error('Error updating ACI: %s', traceback.format_exc())
logger.warning('Reverting entry') logger.warning('Reverting entry')