<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 05/06/2014 11:08 AM, Nathaniel
McCallum wrote:<br>
</div>
<blockquote cite="mid:1399388939.9864.2.camel@ipa.example.com"
type="cite">
<pre wrap="">On Tue, 2014-05-06 at 09:49 -0400, Nathaniel McCallum wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On Mon, 2014-05-05 at 12:42 -0400, Nathaniel McCallum wrote:
</pre>
<blockquote type="cite">
<pre wrap="">This also constitutes a rethinking of the token ACIs after the
introduction of SELFDN support.
Admins, as before, have full access to all token permissions.
Normal users have read/search/compare access to all of the non-secret
data for tokens assigned to them, whether protected or non-protected.
Users can add or delete non-protected tokens and modify most of their
metadata. However they cannot create, delete or modify protected tokens.
Regardless of whether the token is protected or not, users cannot change
a token's ownership or unique identity.
In contrast, admins can create protected tokens. This protects the token
from deletion or modification when assigned to users. Additionally, when
a user account is deleted, the assigned non-protected tokens are deleted
but the protected tokens are merely orphaned. This permits the token to
be reassigned without having to recreate it. This last point is
particularly useful in the case of hardware tokens.
<a class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa/ticket/4228">https://fedorahosted.org/freeipa/ticket/4228</a>
NOTE: This patch depends on my patch 0048.
</pre>
</blockquote>
<pre wrap="">
This new version makes ipatokenDisabled visible for token owners. It is
also writable if the token is non-protected. This additionally fixes:
<a class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa/ticket/4259">https://fedorahosted.org/freeipa/ticket/4259</a>
</pre>
</blockquote>
<pre wrap="">
This new version changes the way the default value of protected is setup
in accordance with the changes made for the review of my patch 0048.2.
Nathaniel
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Freeipa-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-devel@redhat.com">Freeipa-devel@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-devel">https://www.redhat.com/mailman/listinfo/freeipa-devel</a></pre>
</blockquote>
<br>
Have we recorded any new OIDs added as a part of this OTP cleanup in
our OID registry?<br>
If not we should collect all added attributes and make sure they are
recorded.<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</body>
</html>