IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-22 23:23:30 -06:00
Code Issues Packages Projects Releases Wiki Activity

permissions: add permissions for read and mod of external group members

Browse Source 
Issue: "User Administrator" role cannot add users to an External Group.

https://fedorahosted.org/freeipa/ticket/5504

Reviewed-By: Martin Basti <mbasti@redhat.com>
This commit is contained in:
Petr Vobornik 2016-06-23 17:42:17 +02:00 committed by Martin Basti
parent d4ad2c98aa
commit da5487c407
2 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ACI.txt
View File

@ -95,9 +95,13 @@ aci: (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecor
dn: cn=groups,cn=accounts,dc=ipa,dc=example
aci: (targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Add Groups";allow (add) groupdn = "ldap:///cn=System: Add Groups,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=groups,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "ipaexternalmember")(targetfilter = "(objectclass=ipaexternalgroup)")(version 3.0;acl "permission:System: Modify External Group Membership";allow (write) groupdn = "ldap:///cn=System: Modify External Group Membership,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=groups,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "member")(targetfilter = "(&(!(cn=admins))(objectclass=ipausergroup))")(version 3.0;acl "permission:System: Modify Group Membership";allow (write) groupdn = "ldap:///cn=System: Modify Group Membership,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=groups,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "cn || description || gidnumber || ipauniqueid || mepmanagedby || objectclass")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Modify Groups";allow (write) groupdn = "ldap:///cn=System: Modify Groups,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=groups,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "ipaexternalmember")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read External Group Membership";allow (compare,read,search) userdn = "ldap:///all";)
dn: dc=ipa,dc=example
aci: (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=ipa,dc=example")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)
dn: cn=groups,cn=accounts,dc=ipa,dc=example

17
ipaserver/plugins/group.py
View File

@ -194,6 +194,13 @@ class group(LDAPObject):
'member', 'memberof', 'memberuid', 'memberuser', 'memberhost',
},
},
'System: Read External Group Membership': {
'ipapermbindruletype': 'all',
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'ipaexternalmember',
},
},
'System: Add Groups': {
'ipapermright': {'add'},
'replaces': [
@ -216,6 +223,16 @@ class group(LDAPObject):
'Group Administrators', 'Modify Group membership'
},
},
'System: Modify External Group Membership': {
'ipapermright': {'write'},
'ipapermtargetfilter': [
'(objectclass=ipaexternalgroup)',
],
'ipapermdefaultattr': {'ipaexternalmember'},
'default_privileges': {
'Group Administrators', 'Modify Group membership'
},
},
'System: Modify Groups': {
'ipapermright': {'write'},
'ipapermdefaultattr': {