IntenseWebs/freeipa
3
0 Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-10-25 22:50:12 -05:00
Code Issues Packages Projects Releases Wiki Activity

sysaccounts: extend permissions to include description and account lock

Browse Source 
Security Architect role was supposed to manage sysaccount objects. But
since description attribute is missing from the list of the managed
permissions, the role is unable to modify 'description' field. Same for
nsAccountLock which needs an explicit ACI.

Fixes: https://pagure.io/freeipa/issue/9875

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
This commit is contained in:
Alexander Bokovoy authored and Florence Blanc-Renaud committed 2025-11-12 17:16:48 +01:00
1 parent d3909d8601
commit ec22295fed
2 files changed
+5 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ACI.txt
+2 -2
View File
@@ -379,9 +379,9 @@ aci: (targetfilter = "(objectclass=simplesecurityobject)")(version 3.0;acl "perm
dn: cn=sysaccounts,cn=etc,dc=ipa,dc=example
aci: (targetattr = "userpassword")(targetfilter = "(objectclass=simplesecurityobject)")(version 3.0;acl "permission:System: Check System Accounts passwords";allow (search) groupdn = "ldap:///cn=System: Check System Accounts passwords,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=sysaccounts,cn=etc,dc=ipa,dc=example
aci: (targetattr = "userpassword")(targetfilter = "(objectclass=simplesecurityobject)")(version 3.0;acl "permission:System: Modify System Accounts";allow (write) groupdn = "ldap:///cn=System: Modify System Accounts,cn=permissions,cn=pbac,dc=ipa,dc=example";)
aci: (targetattr = "description || nsaccountlock || userpassword")(targetfilter = "(objectclass=simplesecurityobject)")(version 3.0;acl "permission:System: Modify System Accounts";allow (write) groupdn = "ldap:///cn=System: Modify System Accounts,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=sysaccounts,cn=etc,dc=ipa,dc=example
aci: (targetattr = "createtimestamp || entryusn || memberof || modifytimestamp || objectclass || uid")(targetfilter = "(objectclass=simplesecurityobject)")(version 3.0;acl "permission:System: Read System Accounts";allow (compare,read,search) userdn = "ldap:///all";)
aci: (targetattr = "createtimestamp || description || entryusn || memberof || modifytimestamp || nsaccountlock || objectclass || uid")(targetfilter = "(objectclass=simplesecurityobject)")(version 3.0;acl "permission:System: Read System Accounts";allow (compare,read,search) userdn = "ldap:///all";)
dn: cn=sysaccounts,cn=etc,dc=ipa,dc=example
aci: (targetfilter = "(objectclass=simplesecurityobject)")(version 3.0;acl "permission:System: Remove System Accounts";allow (delete) groupdn = "ldap:///cn=System: Remove System Accounts,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=topology,cn=ipa,cn=etc,dc=ipa,dc=example
ipaserver/plugins/sysaccounts.py
+3 -2
View File
@@ -138,7 +138,7 @@ class sysaccount(LDAPObject):
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'objectclass',
'uid', 'memberof'
'uid', 'memberof', 'nsaccountlock', 'description'
},
},
'System: Check System Accounts passwords': {
@@ -152,7 +152,8 @@ class sysaccount(LDAPObject):
},
'System: Modify System Accounts': {
'ipapermright': {'write'},
'ipapermdefaultattr': {'userpassword'},
'ipapermdefaultattr': {'userpassword', 'description',
'nsaccountlock'},
'default_privileges': {'System Accounts Administrators'},
},
'System: Remove System Accounts': {