IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-07-29 15:55:47 -05:00
Code Issues Packages Projects Releases Wiki Activity

Add group membership management

Browse Source 
A group membership manager is a user or a group that can add members to
a group or remove members from a group or host group.

Fixes: https://pagure.io/freeipa/issue/8114
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
This commit is contained in:
Christian Heimes
2019-11-11 09:31:14 +01:00
parent 87c24ebd34
commit f0a1f084b6
17 changed files with 421 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
install/share/60basev2.ldif
+5 -2
View File
@@ -2,6 +2,7 @@
##
## Attributes: 2.16.840.1.113730.3.8.3 - V2 base attributres
## ObjectClasses: 2.16.840.1.113730.3.8.4 - V2 base objectclasses
## Attributes: 2.16.840.1.113730.3.8.23 - V4 base attributes
##
dn: cn=schema
attributeTypes: (2.16.840.1.113730.3.8.3.1 NAME 'ipaUniqueID' DESC 'Unique identifier' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v2' )
@@ -21,8 +22,10 @@ objectClasses: (2.16.840.1.113730.3.8.4.14 NAME 'ipaEntitlement' DESC 'IPA Entit
objectClasses: (2.16.840.1.113730.3.8.4.15 NAME 'ipaPermission' DESC 'IPA Permission objectclass' AUXILIARY MAY ( ipaPermissionType ) X-ORIGIN 'IPA v2' )
objectClasses: (2.16.840.1.113730.3.8.4.2 NAME 'ipaService' DESC 'IPA service objectclass' AUXILIARY MAY ( memberOf $ managedBy $ ipaKrbAuthzData) X-ORIGIN 'IPA v2' )
objectClasses: (2.16.840.1.113730.3.8.4.3 NAME 'nestedGroup' DESC 'Group that supports nesting' SUP groupOfNames STRUCTURAL MAY memberOf X-ORIGIN 'IPA v2' )
objectClasses: (2.16.840.1.113730.3.8.4.4 NAME 'ipaUserGroup' DESC 'IPA user group object class' SUP nestedGroup STRUCTURAL X-ORIGIN 'IPA v2' )
objectClasses: (2.16.840.1.113730.3.8.4.5 NAME 'ipaHostGroup' DESC 'IPA host group object class' SUP nestedGroup STRUCTURAL X-ORIGIN 'IPA v2' )
# Same for memberManager except it's actually v4 attribute
attributeTypes: (2.16.840.1.113730.3.8.23.1 NAME 'memberManager' DESC 'DNs of entries allowed to manage group membership' SUP distinguishedName EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'IPA v4')
objectClasses: (2.16.840.1.113730.3.8.4.4 NAME 'ipaUserGroup' DESC 'IPA user group object class' SUP nestedGroup STRUCTURAL MAY memberManager X-ORIGIN 'IPA v2' )
objectClasses: (2.16.840.1.113730.3.8.4.5 NAME 'ipaHostGroup' DESC 'IPA host group object class' SUP nestedGroup STRUCTURAL MAY memberManager X-ORIGIN 'IPA v2' )
attributeTypes: (2.16.840.1.113730.3.8.3.5 NAME 'memberUser' DESC 'Reference to a principal that performs an action (usually user).' SUP distinguishedName EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'IPA v2' )
attributeTypes: (2.16.840.1.113730.3.8.3.6 NAME 'userCategory' DESC 'Additional classification for users' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v2' )
attributeTypes: (2.16.840.1.113730.3.8.3.7 NAME 'memberHost' DESC 'Reference to a device where the operation takes place (usually host).' SUP distinguishedName EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'IPA v2' )
install/share/default-aci.ldif
+13
View File
@@ -70,6 +70,19 @@ changetype: modify
add: aci
aci: (targetattr = "krbPrincipalKey || krbLastPwdChange")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "Admins can manage host keytab";allow (write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,$SUFFIX";)
# Allow member managers to modify members of user groups
dn: cn=groups,cn=accounts,$SUFFIX
changetype: modify
add: aci
aci: (targetattr = "member")(targetfilter = "(objectclass=ipaUserGroup)")(version 3.0; acl "Allow member managers to modify members of user groups"; allow (write) userattr = "memberManager#USERDN" or userattr = "memberManager#GROUPDN";)
# Allow member managers to modify members of a host group
dn: cn=hostgroups,cn=accounts,$SUFFIX
changetype: modify
add: aci
aci: (targetattr = "member")(targetfilter = "(objectclass=ipaHostGroup)")(version 3.0; acl "Allow member managers to modify members of host groups"; allow (write) userattr = "memberManager#USERDN" or userattr = "memberManager#GROUPDN";)
# This is used for the host/service one-time passwordn and keytab indirectors.
# We can do a query on a DN to see if an attribute exists.
dn: cn=accounts,$SUFFIX
install/share/indices.ldif
+9
View File
@@ -417,3 +417,12 @@ objectClass: top
objectClass: nsIndex
nsSystemIndex: false
nsIndexType: eq
dn: cn=memberManager,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
changetype: add
cn: memberManager
objectClass: top
objectClass: nsIndex
nsSystemIndex: false
nsIndexType: eq
nsIndexType: pres
install/ui/src/freeipa/entity.js
+2 -1
View File
@@ -442,7 +442,8 @@ exp.entity_builder = IPA.entity_builder = function(entity) {
'member',
'settings',
'memberof',
'managedby'
'managedby',
'membermanager'
];
/**
install/ui/src/freeipa/group.js
+14
View File
@@ -151,6 +151,20 @@ return {
}
]
},
{
$type: 'association',
name: 'membermanager_group',
associator: IPA.serial_associator,
add_title: '@i18n:objects.group.add_membermanager_group',
remove_title: '@i18n:objects.group.remove_membermanager_group'
},
{
$type: 'association',
name: 'membermanager_user',
associator: IPA.serial_associator,
add_title: '@i18n:objects.group.add_membermanager_user',
remove_title: '@i18n:objects.group.remove_membermanager_user'
},
{
$type: 'association',
name: 'memberof_group',
install/ui/src/freeipa/hostgroup.js
+16
View File
@@ -63,15 +63,31 @@ return {
}
]
},
{
$type: 'association',
name: 'membermanager_group',
associator: IPA.serial_associator,
add_title: '@i18n:objects.hostgroup.add_membermanager_group',
remove_title: '@i18n:objects.hostgroup.remove_membermanager_group'
},
{
$type: 'association',
name: 'membermanager_user',
associator: IPA.serial_associator,
add_title: '@i18n:objects.hostgroup.add_membermanager_user',
remove_title: '@i18n:objects.hostgroup.remove_membermanager_user'
},
{
$type: 'association',
name: 'member_host',
associator: IPA.serial_associator,
add_title: '@i18n:objects.hostgroup.add_hosts',
remove_title: '@i18n:objects.hostgroup.remove_hosts'
},
{
$type: 'association',
name: 'member_hostgroup',
associator: IPA.serial_associator,
add_title: '@i18n:objects.hostgroup.add_hostgroups',
remove_title: '@i18n:objects.hostgroup.remove_hostgroups'
},
install/updates/20-aci.update
+8
View File
@@ -132,6 +132,14 @@ add:aci: (targetfilter="(|(objectclass=ipaHost)(objectclass=ipaService))")(targe
dn: $SUFFIX
add:aci:(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)
# Allow member managers to modify members of user groups
dn: cn=groups,cn=accounts,$SUFFIX
add:aci: (targetattr = "member")(targetfilter = "(objectclass=ipaUserGroup)")(version 3.0; acl "Allow member managers to modify members of user groups"; allow (write) userattr = "memberManager#USERDN";)
# Allow member managers to modify members of host groups
dn: cn=hostgroups,cn=accounts,$SUFFIX
add:aci: (targetattr = "member")(targetfilter = "(objectclass=ipaHostGroup)")(version 3.0; acl "Allow member managers to modify members of host groups"; allow (write) userattr = "memberManager#USERDN";)
# Hosts can add and delete their own services
dn: cn=services,cn=accounts,$SUFFIX
remove:aci: (target = "ldap:///krbprincipalname=*/($$dn)@$REALM,cn=services,cn=accounts,$SUFFIX")(targetfilter = "(objectClass=ipaKrbPrincipal)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($$dn),cn=computers,cn=accounts,$SUFFIX";)
install/updates/20-indices.update
+8
View File
@@ -380,3 +380,11 @@ default: objectClass: top
default: objectClass: nsIndex
default: nsSystemIndex: false
default: nsIndexType: eq
dn: cn=memberManager,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
default: cn: memberManager
default: objectClass: top
default: objectClass: nsIndex
default: nsSystemIndex: false
default: nsIndexType: eq
default: nsIndexType: pres
install/updates/25-referint.update
+1
View File
@@ -20,3 +20,4 @@ add: referint-membership-attr: ipaallowedtarget
add: referint-membership-attr: ipamemberca
add: referint-membership-attr: ipamembercertprofile
add: referint-membership-attr: ipalocation
add: referint-membership-attr: membermanager