From eeb085b59b5aeb41d6987397c47d7db7130f260e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tibor=20Dudl=C3=A1k?= Date: Wed, 24 May 2017 11:02:19 +0200 Subject: [PATCH] Add permission to grant 'add' on cas container https://pagure.io/freeipa/issue/6609 --- ACI.txt | 2 ++ ipaserver/install/plugins/update_managed_permissions.py | 8 ++++++++ 2 files changed, 10 insertions(+) diff --git a/ACI.txt b/ACI.txt index 185812a881..30b8efab88 100644 --- a/ACI.txt +++ b/ACI.txt @@ -414,6 +414,8 @@ dn: cn=certificates,cn=ipa,cn=etc,dc=ipa,dc=example aci: (targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Add Certificate Store Entry";allow (add) groupdn = "ldap:///cn=System: Add Certificate Store Entry,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: dc=ipa,dc=example aci: (targetattr = "ipaanchoruuid")(target = "ldap:///cn=*,cn=compat,dc=ipa,dc=example")(targetfilter = "(objectclass=ipaOverrideTarget)")(version 3.0;acl "permission:System: Compat Tree ID View targets";allow (compare,read,search) userdn = "ldap:///anyone";) +dn: cn=cas,cn=ca,dc=ipa,dc=example +aci: (targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Grant add on CAS container";allow (add) groupdn = "ldap:///cn=System: Grant add on CAS container,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=CAcert,cn=ipa,cn=etc,dc=ipa,dc=example aci: (targetattr = "cacertificate")(targetfilter = "(objectclass=pkica)")(version 3.0;acl "permission:System: Modify CA Certificate";allow (write) groupdn = "ldap:///cn=System: Modify CA Certificate,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=ca_renewal,cn=ipa,cn=etc,dc=ipa,dc=example diff --git a/ipaserver/install/plugins/update_managed_permissions.py b/ipaserver/install/plugins/update_managed_permissions.py index 33983fd107..05af4cc3aa 100644 --- a/ipaserver/install/plugins/update_managed_permissions.py +++ b/ipaserver/install/plugins/update_managed_permissions.py @@ -291,6 +291,14 @@ 'ipadomainlevel', 'objectclass', }, }, + 'System: Grant add on CAS container': { + 'replaces_global_anonymous_aci': True, + 'ipapermlocation': DN('cn=cas,cn=ca', api.env.basedn), + 'ipapermtargetfilter': {'(objectclass=nscontainer)'}, + 'ipapermbindruletype': 'permission', + 'ipapermright': {'add'}, + 'default_privileges': {'CA Administrator'}, + }, }