4 Commits

Author	SHA1	Message	Date
Jan Cholasta	964e7e906a	makeaci: Use LDAPClient instead of IPASimpleLDAPObject ... Reviewed-By: Petr Viktorin <pviktori@redhat.com>	2015-04-16 06:58:31 +00:00
Petr Viktorin	afe067b1ab	makeaci: Use the DN where the ACI is stored, not the permission's DN ... Reviewed-By: Martin Basti <mbasti@redhat.com>	2014-07-07 14:42:52 +02:00
Petr Viktorin	b6258d08d6	Make sure member* attrs are always granted together in read permissions ... Memberofindirect processing of an entry doesn't work if the user doesn't have rights to any one of these attributes: - member - memberuser - memberhost Add all of these to any read permission that specifies any of them. Add a check to makeaci that will enforce this for any future permissions. Reviewed-By: Martin Kosek <mkosek@redhat.com>	2014-06-11 13:21:30 +02:00
Petr Viktorin	6acaf73b0c	Add ACI.txt ... The ACI.txt file is a list all managed permissions in ACI form. Similarly to API.txt, it ensures that changes are not made lightly, since modifications must be reflected in ACI.txt and committed to Git. Add a script, makeaci, which parallels makeapi: it recreates or validates ACI.txt. Call makeaci --validate before the build, just after API.txt is validated. Reviewed-By: Martin Kosek <mkosek@redhat.com>	2014-06-11 13:21:29 +02:00