<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> On 12/01/2010 05:07 PM, Adam Young wrote: <blockquote cite="mid:4CF6C71F.3060306@redhat.com" type="cite"> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> The attached patch is required on top of the changes, as the admin user no longer has any rolegroup, and thus would see the self service api. It should be pushed with this patch. </blockquote> posted the wrong version. THis one checks for presence of the group admins. <blockquote cite="mid:4CF6C71F.3060306@redhat.com" type="cite"> On 12/01/2010 04:01 PM, Rob Crittenden wrote: <blockquote cite="mid:4CF6B7BA.10906@redhat.com" type="cite">Simo Sorce wrote: <blockquote type="cite">On Thu, 18 Nov 2010 23:11:51 -0500 Rob Crittenden<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:rcritten@redhat.com"><rcritten@redhat.com></a> wrote: <blockquote type="cite">Re-implement access control using an updated model. The new model is based on permissions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. <a moz-do-not-send="true" class="moz-txt-link-freetext" href="ldap:///self">ldap:///self</a> and groups granting groups (v1-style) are not supported by this model (it will be provided separately). ticket 445 WARNING. The patch is humongous and changes a whole slew of stuff. It patches cleanly against the master right now but it is quite delicate so the sooner this is reviewed (without pushing anything else) the better. The self-tests all pass for me as well as some spot checking. Also note that I currently define a single role and it has no privileges. We will need to fill that in soon. </blockquote> Sorry Rob, but before I can ACK a change of this proportion in the Security model I want a wiki page with the model explained clearly and in detail. I am vetoing this patch until we have that. Note, I am *not* saying the patch is wrong, only that reviewing it w/o a reference model is basically impossible and it touches sensitive security stuff so I can't just let it pass hoping we got everything right. Simo. </blockquote> Adam found a bug when installing the DNS server. Updated patch attached. rob <pre wrap=""><fieldset class="mimeAttachmentHeader"></fieldset> _______________________________________________ Freeipa-devel mailing list <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:Freeipa-devel@redhat.com">Freeipa-devel@redhat.com</a> <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-devel">https://www.redhat.com/mailman/listinfo/freeipa-devel</a></pre> </blockquote> <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> _______________________________________________ Freeipa-devel mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-devel@redhat.com">Freeipa-devel@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-devel">https://www.redhat.com/mailman/listinfo/freeipa-devel</a></pre> </blockquote> </body> </html>