[Freeipa-devel] Compat tree permissions

[Petr Viktorin]

On 09/03/2014 10:17 AM, Martin Kosek wrote:
[...]
>> Exposing the same data anonymously over compat tree when it is available
>> only for authenticated users over primary tree isn't secure.
>
> If you check
> cn=users,cn=Schema Compatibility,cn=plugins,cn=config
> you would see that we only allow attributes we already expose to anonymous as
> in the basic permission. So it is not that bad.

For users, yes. I assume we want the others to be authenticated only?

> But maybe we should add a new internal "link" between standard and compat tree
> permissions and issue a warning when visibility of one is changed...
>
> Regarding missing compat permissions, I would personally add these:
>
> System: Read User Compat Tree
> System: Read Group Compat Tree
> System: Read Host Compat Tree
> System: Read Netgroup Compat Tree
>
> so that they are close to their standard tree alternatives.


-- 
Petr³