[Freeipa-devel] [PATCH] 552-557 Permissions v2 Web UI

[Petr Viktorin]

On 03/18/2014 01:09 PM, Petr Vobornik wrote:
> New revision for patch patch #557 attached.
>
> On 17.3.2014 15:22, Petr Viktorin wrote:
>> On 03/14/2014 06:47 PM, Petr Vobornik wrote:
>>> Main ACI UI changes are in patch #557. The rest are prerequisites.
>>
>> With this UI it is impossible to change from "Type-based" permissions to
>> "General" ones. This seems to be remaining from the old model where
>> permissions were type/filter/subtree/targetgroup were "classes" of a
>> permission rather than co-existing as attributes.
>>
>> Rather the Target section should IMO look the same for all (non-managed)
>> permissions, with the first items being:
>>      Type:    [drop-down with a None option]
>>      Subtree: [textbox that is disabled when a Type is selected]
>>
>> The Subtree should be a one-line textbox. It would be acceptable if the
>> whole DN doesn't always fit, it's the first part that's important.
>>
>> Remember to only send Subtree if Type is (staying as | being set to)
>> None.
>>
>> Also, the Add dialog should use this instead of the "Define by".
>
> Done
>
>>
>>
>>
>> With managed permissions, if I try to change both included/excluded
>> attribute list and the effective attributes, I get a validation error,
>> which is good in CLI but it doesn't work well for the UI.
>>
>> I think it would be better to move "Managed permission overrides" below
>> "Target", and make it read-only. And perhaps rename it to something like
>> "Attribute breakdown".
>> Managing the included/excluded lists directly is only useful for
>> upgrades with a heavily customized policy, and for upgrades you need the
>> CLI anyway. Normally, having only the attribute list editable should be
>> fine.
>
> Done
>
>>
>>
>>
>> For SYSTEM permissions (those which only have the SYSTEM flag), such as
>> 'Add Automember Rebuild Membership Task', Permissions should not be
>> editable.
>> For old-style permissions (those without any flags), nothing is editable
>> but everything should be. The attributelevelrights are missing because
>> the entry doesn't have the ipaPermissionV2 objectclass yet (although
>> it's being reported, which is "my" bug -- #4257).
>
> Fields were set to be editable if attributes level rights are missing.

That solves things for normal legacy permissions, but not for the SYSTEM 
ones - those should be completely read-only.

Also, changing the Permisisons checkboxes on these permissions doesn't 
mark them dirty.

Otherwise the patches work great!

-- 
Petr³