[Freeipa-devel] [PATCH] 0168 add permission for reading ipaSshPubkey for ID overrides

[Alexander Bokovoy]

On Fri, 24 Oct 2014, Alexander Bokovoy wrote:
> Hi!
> 
> A small patch to fix https://fedorahosted.org/freeipa/ticket/4664
> 
Sumit noted that we also miss gidNumber from the user's override
permissions. Added to the new version of the patch.

-- 
/ Alexander Bokovoy
-------------- next part --------------
From f980405957aeb912b28f8559416faba9c6bbd1bb Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy at redhat.com>
Date: Fri, 24 Oct 2014 15:01:27 +0300
Subject: [PATCH] Add ipaSshPubkey to the ACI to read ID user overrides

https://fedorahosted.org/freeipa/ticket/4664
---
 ACI.txt                   | 2 +-
 ipalib/plugins/idviews.py | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/ACI.txt b/ACI.txt
index 27a5d2f..6680f65 100644
--- a/ACI.txt
+++ b/ACI.txt
@@ -131,7 +131,7 @@ aci: (targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:S
 dn: cn=views,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "cn || createtimestamp || description || entryusn || gidnumber || ipaanchoruuid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaGroupOverride)")(version 3.0;acl "permission:System: Read Group ID Overrides";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=views,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "createtimestamp || description || entryusn || gecos || homedirectory || ipaanchoruuid || ipaoriginaluid || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaUserOverride)")(version 3.0;acl "permission:System: Read User ID Overrides";allow (compare,read,search) userdn = "ldap:///all";)
+aci: (targetattr = "createtimestamp || description || entryusn || gecos || gidnumber || homedirectory || ipaanchoruuid || ipaoriginaluid || ipasshpubkey || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaUserOverride)")(version 3.0;acl "permission:System: Read User ID Overrides";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=ranges,cn=etc,dc=ipa,dc=example
 aci: (targetattr = "cn || createtimestamp || entryusn || ipabaseid || ipabaserid || ipaidrangesize || ipanttrusteddomainsid || iparangetype || ipasecondarybaserid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidrange)")(version 3.0;acl "permission:System: Read ID Ranges";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=views,cn=accounts,dc=ipa,dc=example
diff --git a/ipalib/plugins/idviews.py b/ipalib/plugins/idviews.py
index bfa8675..9c87210 100644
--- a/ipalib/plugins/idviews.py
+++ b/ipalib/plugins/idviews.py
@@ -659,6 +659,7 @@ class idoverrideuser(baseidoverride):
             'ipapermdefaultattr': {
                 'objectClass', 'ipaAnchorUUID', 'uidNumber', 'description',
                 'homeDirectory', 'uid', 'ipaOriginalUid', 'loginShell', 'gecos',
+                'gidNumber', 'ipaSshPubkey',
             },
         },
     }
-- 
2.1.0