[Freeipa-devel] [PATCH] Password vault
Endi Sukma Dewata
edewata at redhat.com
Tue Jul 7 14:42:04 UTC 2015
----- Original Message -----
> On 07/07/2015 10:51 AM, Jan Cholasta wrote:
> > Dne 3.7.2015 v 15:44 Endi Sukma Dewata napsal(a):
> >> Here is the rebased patch for vault access control.
> >>
> >
> > LGTM, except:
> >
> > @@ -356,6 +386,13 @@ class vault(LDAPObject):
> > {
> > 'objectclass': ['nsContainer'],
> > 'cn': rdn['cn'],
> > + 'aci':
> > + '(targetfilter="(objectClass=ipaVault)")' +
> > + '(version 3.0; ' +
> > + 'acl "User can manage private vaults"; ' +
> > + 'allow(read, search, compare, add, delete) ' +
> > + 'userdn="ldap:///%s";)'
> > + % owner_dn
> > })
> >
> > # if entry can be added, return
> >
> > I don't think dynamically creating ACIs with hardcoded userdn is something
> > we
> > want to do. This should be handled by a single ACI in cn=vaults.
>
> +1. Single ACI like
>
> +default: aci: (targetfilter="(objectClass=ipaVault)")(version 3.0; acl
> "Vault
> owners can manage the vault"; allow(read, search, compare, write)
> userattr="owner#USERDN";)
>
> you already have there is more preferred.
New patch attached. For this to work the container itself needs an 'owner' attribute, so I changed the nsContainer into ipaVaultContainer.
--
Endi S. Dewata
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-edewata-0355-8-Added-vault-access-control.patch
Type: text/x-patch
Size: 31142 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20150707/bfff17e1/attachment.bin>
More information about the Freeipa-devel
mailing list