Add the permission to Stage users administrators to delete already
preserved user
From a1d4905af6784e12b0a47a32418ec5e3d5a7d769 Mon Sep 17 00:00:00 2001
From: root <r...@vm-205.idm.lab.eng.brq.redhat.com>
Date: Fri, 19 Jun 2015 17:27:11 +0200
Subject: [PATCH] User life cycle: permission to delete a preserved user
Add permission to delete an entry from Delete container
https://fedorahosted.org/freeipa/ticket/3813
---
ACI.txt | 2 ++
ipalib/plugins/stageuser.py | 10 ++++++++++
2 files changed, 12 insertions(+)
diff --git a/ACI.txt b/ACI.txt
index 4d019cbc2c8ee6ad8051b1eb975964ebca64d7a0..9206d76ed55aaabd278452ba08cf202a4eab1200 100644
--- a/ACI.txt
+++ b/ACI.txt
@@ -265,6 +265,8 @@ aci: (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=p
dn: cn=staged users,cn=accounts,cn=provisioning,dc=ipa,dc=example
aci: (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=ipa,dc=example")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove Stage User";allow (delete) groupdn = "ldap:///cn=System: Remove Stage User,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example
+aci: (targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove preserved User";allow (delete) groupdn = "ldap:///cn=System: Remove preserved User,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example
aci: (targetattr = "krblastpwdchange || krbpasswordexpiration || krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Reset Preserved User password";allow (read,search,write) groupdn = "ldap:///cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: dc=ipa,dc=example
aci: (target_to = "ldap:///cn=users,cn=accounts,dc=ipa,dc=example";)(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=ipa,dc=example";)
diff --git a/ipalib/plugins/stageuser.py b/ipalib/plugins/stageuser.py
index 18e09e957158bd53bdb8d295a8bf91a823e16ca7..7c714f627f000f7b013b60b096e72587cf935022 100644
--- a/ipalib/plugins/stageuser.py
+++ b/ipalib/plugins/stageuser.py
@@ -202,6 +202,16 @@ class stageuser(baseuser):
},
'default_privileges': {'Stage User Administrators'},
},
+ # Allow to delete preserved user
+ 'System: Remove preserved User': {
+ 'ipapermlocation': DN(baseuser.delete_container_dn, api.env.basedn),
+ 'ipapermbindruletype': 'permission',
+ 'ipapermtarget': DN('uid=*', baseuser.delete_container_dn, api.env.basedn),
+ 'ipapermtargetfilter': {'(objectclass=*)'},
+ 'ipapermright': {'delete'},
+ 'ipapermdefaultattr': {'*'},
+ 'default_privileges': {'Stage User Administrators'},
+ },
#
# Active container
#
--
2.1.0
--
Manage your subscription for the Freeipa-devel mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-devel
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code
