[Freeipa-devel] Stage users - inconsistent permission names
Martin Kosek
mkosek at redhat.com
Wed Jun 10 07:12:57 UTC 2015
Hello Thierry/David,
I saw the new privileges and permissions for the Staged Users functionality and
found couple spelling/English issues that I think we should fix before Alpha/GA
so that we can just rename them and not care about upgrade changes.
Namely:
# ipa permission-find stage | grep -i "Permission name"
Permission name: System: Add Stage Users by Provisioning and Administrators
Should be "System: Add Stage User"
Permission should not care who will do it, it is privilege/role's job.
Permission name: System: Delete modify Stage Users by administrators
Why is Modify and Delete combined in 1 permission?
Should be "System: Modify Stage User" and "System: Remove Stage User"
Permission name: System: Preserve an active user to a delete Users
Maybe "System: Preserve User"? We do not use "deleted users" bur rather
"preserved users anyway"
Permission name: System: Reactive delete users
"System: Undelete User" to reflect the command name.
Permission name: System: Read Stage User kerberos principal key and password
Rather "System: Read Stage User password" - I do not think we need to call out
the principal key explicitly, but this is negotiable.
Permission name: System: Read Stage Users by administrators
"System: Read Stage Users"
Permission name: System: Read/Write delete Users by administrators
This needs to be 2 permissions:
"System: Read Preserved Users"
"System: Modify Preserved Users"
Permission name: System: Reset userPassord and kerberos keys of delete users
by administrator
Rather "System: Reset Preserved User password"
Permission name: System: Write Active Users RDN by administrators
Rather "System: Modify User RDN"
Permission name: System: Write Delete Users RDN by administrators
Why is this permission needed, isn't "System: Modify Preserved Users" enough?
--
Martin Kosek <mkosek at redhat.com>
Supervisor, Software Engineering - Identity Management Team
Red Hat Inc.
More information about the Freeipa-devel
mailing list