[Freeipa-devel] [PATCH] 477 Add Modify Realm Domains permission

[Petr Spacek]

On 4.7.2014 09:34, Martin Kosek wrote:
> The permission is required for DNS Administrators as realm domains
> object is updated when a master zone is added.
>
> https://fedorahosted.org/freeipa/ticket/4423

I can't resist ;-)

NACK: Build failed.

--- existing ACI.txt
+++ new result
@@ -154,6 +154,8 @@
  aci: (targetattr = "krbmaxpwdlife || krbminpwdlife || 
krbpwdfailurecountinterval || krbpwdhistorylength || krbpwdlockoutduration || 
krbpwdmaxfailure || krbpwdmindiffchars || krbpwdminlength")(targetfilter = 
"(objectclass=krbpwdpolicy)")(version 3.0;acl "permission:System: Modify Group 
Password Policy";allow (write) groupdn = "ldap:///cn=System: Modify Group 
Password Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";)
  dn: cn=System: Read Group Password 
Policy,cn=permissions,cn=pbac,dc=ipa,dc=example
  aci: (targetattr = "cn || cospriority || krbmaxpwdlife || krbminpwdlife || 
krbpwdfailurecountinterval || krbpwdhistorylength || krbpwdlockoutduration || 
krbpwdmaxfailure || krbpwdmindiffchars || krbpwdminlength || 
objectclass")(targetfilter = "(objectclass=krbpwdpolicy)")(version 3.0;acl 
"permission:System: Read Group Password Policy";allow (compare,read,search) 
groupdn = "ldap:///cn=System: Read Group Password 
Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=System: Modify Realm Domains,cn=permissions,cn=pbac,dc=ipa,dc=example
+aci: (targetattr = "associateddomain")(targetfilter = 
"(objectclass=domainrelatedobject)")(version 3.0;acl "permission:System: 
Modify Realm Domains";allow (write) groupdn = "ldap:///cn=System: Modify Realm 
Domains,cn=permissions,cn=pbac,dc=ipa,dc=example";)
  dn: cn=System: Read Realm Domains,cn=permissions,cn=pbac,dc=ipa,dc=example
  aci: (targetattr = "associateddomain || cn || objectclass")(targetfilter = 
"(objectclass=domainrelatedobject)")(version 3.0;acl "permission:System: Read 
Realm Domains";allow (compare,read,search) userdn = "ldap:///all";)
  dn: cn=System: Add Roles,cn=permissions,cn=pbac,dc=ipa,dc=example

Managed permission ACI validation failed.
Re-check permission changes and run `makeaci`.
ACI.txt validation failed

-- 
Petr^2 Spacek