From ec22295fede3f1c71b6111e4d36a7386080cf39e Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 12 Nov 2025 13:38:14 +0200 Subject: [PATCH] sysaccounts: extend permissions to include description and account lock Security Architect role was supposed to manage sysaccount objects. But since description attribute is missing from the list of the managed permissions, the role is unable to modify 'description' field. Same for nsAccountLock which needs an explicit ACI. Fixes: https://pagure.io/freeipa/issue/9875 Signed-off-by: Alexander Bokovoy Reviewed-By: Florence Blanc-Renaud --- ACI.txt | 4 ++-- ipaserver/plugins/sysaccounts.py | 5 +++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/ACI.txt b/ACI.txt index 8db1634bc..b3c87bac9 100644 --- a/ACI.txt +++ b/ACI.txt @@ -379,9 +379,9 @@ aci: (targetfilter = "(objectclass=simplesecurityobject)")(version 3.0;acl "perm dn: cn=sysaccounts,cn=etc,dc=ipa,dc=example aci: (targetattr = "userpassword")(targetfilter = "(objectclass=simplesecurityobject)")(version 3.0;acl "permission:System: Check System Accounts passwords";allow (search) groupdn = "ldap:///cn=System: Check System Accounts passwords,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=sysaccounts,cn=etc,dc=ipa,dc=example -aci: (targetattr = "userpassword")(targetfilter = "(objectclass=simplesecurityobject)")(version 3.0;acl "permission:System: Modify System Accounts";allow (write) groupdn = "ldap:///cn=System: Modify System Accounts,cn=permissions,cn=pbac,dc=ipa,dc=example";) +aci: (targetattr = "description || nsaccountlock || userpassword")(targetfilter = "(objectclass=simplesecurityobject)")(version 3.0;acl "permission:System: Modify System Accounts";allow (write) groupdn = "ldap:///cn=System: Modify System Accounts,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=sysaccounts,cn=etc,dc=ipa,dc=example -aci: (targetattr = "createtimestamp || entryusn || memberof || modifytimestamp || objectclass || uid")(targetfilter = "(objectclass=simplesecurityobject)")(version 3.0;acl "permission:System: Read System Accounts";allow (compare,read,search) userdn = "ldap:///all";) +aci: (targetattr = "createtimestamp || description || entryusn || memberof || modifytimestamp || nsaccountlock || objectclass || uid")(targetfilter = "(objectclass=simplesecurityobject)")(version 3.0;acl "permission:System: Read System Accounts";allow (compare,read,search) userdn = "ldap:///all";) dn: cn=sysaccounts,cn=etc,dc=ipa,dc=example aci: (targetfilter = "(objectclass=simplesecurityobject)")(version 3.0;acl "permission:System: Remove System Accounts";allow (delete) groupdn = "ldap:///cn=System: Remove System Accounts,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=topology,cn=ipa,cn=etc,dc=ipa,dc=example diff --git a/ipaserver/plugins/sysaccounts.py b/ipaserver/plugins/sysaccounts.py index a67d8b2fb..ad579eeed 100644 --- a/ipaserver/plugins/sysaccounts.py +++ b/ipaserver/plugins/sysaccounts.py @@ -138,7 +138,7 @@ class sysaccount(LDAPObject): 'ipapermright': {'read', 'search', 'compare'}, 'ipapermdefaultattr': { 'objectclass', - 'uid', 'memberof' + 'uid', 'memberof', 'nsaccountlock', 'description' }, }, 'System: Check System Accounts passwords': { @@ -152,7 +152,8 @@ class sysaccount(LDAPObject): }, 'System: Modify System Accounts': { 'ipapermright': {'write'}, - 'ipapermdefaultattr': {'userpassword'}, + 'ipapermdefaultattr': {'userpassword', 'description', + 'nsaccountlock'}, 'default_privileges': {'System Accounts Administrators'}, }, 'System: Remove System Accounts': {