IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-25 08:21:05 -06:00
Code Issues Packages Projects Releases Wiki Activity

Add managed read permissions to user

Browse Source 
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
This commit is contained in:
Petr Viktorin 2014-03-26 17:11:23 +01:00
parent db7d0219ba
commit 791ec1e014
1 changed files with 70 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

70
ipalib/plugins/user.py
View File

@ -233,6 +233,76 @@ class user(LDAPObject):
bindable = True
password_attributes = [('userpassword', 'has_password'),
('krbprincipalkey', 'has_keytab')]
managed_permissions = {
'System: Read User Standard Attributes': {
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'anonymous',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'objectclass', 'cn', 'sn', 'description', 'title', 'uid',
'displayname', 'givenname', 'initials', 'manager', 'gecos',
'gidnumber', 'homedirectory', 'loginshell', 'uidnumber'
},
},
'System: Read User Addressbook Attributes': {
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'all',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'seealso', 'telephonenumber',
'fax', 'l', 'ou', 'st', 'postalcode', 'street',
'destinationindicator', 'internationalisdnnumber',
'physicaldeliveryofficename', 'postaladdress', 'postofficebox',
'preferreddeliverymethod', 'registeredaddress',
'teletexterminalidentifier', 'telexnumber', 'x121address',
'carlicense', 'departmentnumber', 'employeenumber',
'employeetype', 'preferredlanguage', 'mail', 'mobile', 'pager',
'audio', 'businesscategory', 'homephone', 'homepostaladdress',
'jpegphoto', 'labeleduri', 'o', 'photo', 'roomnumber',
'secretary', 'usercertificate',
'usersmimecertificate', 'x500uniqueidentifier',
'inetuserhttpurl', 'inetuserstatus',
},
},
'System: Read User IPA Attributes': {
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'all',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'ipauniqueid', 'ipasshpubkey', 'ipauserauthtype', 'userclass',
},
},
'System: Read User Kerberos Attributes': {
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'all',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'krbprincipalname', 'krbcanonicalname', 'krbprincipalaliases',
'krbprincipalexpiration', 'krbpasswordexpiration',
'krblastpwdchange', 'nsaccountlock', 'krbprincipaltype',
},
},
'System: Read User Kerberos Login Attributes': {
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'permission',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'krblastsuccessfulauth', 'krblastfailedauth',
'krblastpwdchange', 'krblastadminunlock',
'krbloginfailedcount', 'krbpwdpolicyreference',
'krbticketpolicyreference', 'krbupenabled',
},
'default_privileges': {'User Administrators'},
},
'System: Read User Membership': {
'replaces_global_anonymous_aci': True,
'ipapermbindruletype': 'all',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'memberof',
},
},
}
label = _('Users')
label_singular = _('User')