#xPc @ s d d k Td d k l Z l Z l Z d d k l Z l Z l Z d d k l Z d d k l
Z
d d k l Z l
Z
e d Z d Z e d d
e d e d d
e d
f Z d Z d e f d YZ e i e d e f d YZ e i e d e f d YZ e i e d e f d YZ e i e d e f d YZ e i e d e f d YZ e i e d e f d YZ e i e d e f d YZ! e i e! d e" f d YZ# e i e# d! S(" i( t *( t apit _t ngettext( t Flagt Strt StrEnum( t context( t errors( t DNt
EditableDNs
Permissions
A permission enables fine-grained delegation of rights. A permission is
a human-readable form of a 389-ds Access Control Rule, or instruction (ACI).
A permission grants the right to perform a specific task such as adding a
user, modifying a group, etc.
A permission may not contain other permissions.
* A permission grants access to read, write, add or delete.
* A privilege combines similar permissions (for example all the permissions
needed to add a user).
* A role grants a set of privileges to users, groups, hosts or hostgroups.
A permission is made up of a number of different parts:
1. The name of the permission.
2. The target of the permission.
3. The rights granted by the permission.
Rights define what operations are allowed, and may be one or more
of the following:
1. write - write one or more attributes
2. read - read one or more attributes
3. add - add a new entry to the tree
4. delete - delete an existing entry
5. all - all permissions are granted
Read permission is granted for most attributes by default so the read
permission is not expected to be used very often.
Note the distinction between attributes and entries. The permissions are
independent, so being able to add a user does not mean that the user will
be editable.
There are a number of allowed targets:
1. type: a type of object (user, group, etc).
2. memberof: a member of a group or hostgroup
3. filter: an LDAP filter
4. subtree: an LDAP filter specifying part of the LDAP DIT. This is a
super-set of the "type" target.
5. targetgroup: grant access to modify a specific group (such as granting
the rights to manage group membership)
EXAMPLES:
Add a permission that grants the creation of users:
ipa permission-add --type=user --permissions=add "Add Users"
Add a permission that grants the ability to manage group membership:
ipa permission-add --attrs=member --permissions=write --type=group "Manage Group Members"
u
permissiont ipapermissiontypet labels Permission Typet acit ACIc s t f d | D S( s Return a dict that includes entries from `options` that are in `keys`
example:
>>> filtered = filter_options({'a': 1, 'b': 2, 'c': 3}, ['a', 'c'])
>>> filtered == {'a': 1, 'c': 3}
True
c 3 s4 x- | ]& } | j o | | f Vq q Wd S( N( ( t .0t k( t options( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pys d s ( t dict( R t keys( ( R s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyt filter_options\ s t
permissionc B s7 e Z d Z e i i Z e d Z e d Z d d g Z
d d d d d g Z d
d d d d
d d d d g Z h d g d 6Z
e Z e d Z e d Z e d d d d e d d e d d d d e d d d d e d d e d d e e d! d d d e d" d e d# d e d$ d% d& d' e d( d d
d e d) d e d* d+ dA d& d' e d3 d d d e d4 d e d5 d& d' e d6 d d d e d7 d e d8 d& d' e d9 d d d e d: d e d; d& d' e d< d d d e d= d e d> d& d' f Z d? Z d@ Z RS(B s
Permission object.
R t permissionst groupofnamest
ipapermissiont cnt membert memberoft memberindirectR R
t groupt attrst typet filtert subtreet targetgroupt privileget Permissionst
Permissiont cli_namet nameR s Permission namet primary_keyt patterns ^[-_ a-zA-Z0-9]+$t pattern_errmsgs2 May only contain letters, numbers, -, _, and spaces permissions+t docsL Comma-separated list of permissions to grant (read, write, add, delete, all)t csvs attrs*t
Attributess" Comma-separated list of attributest
normalizerc C s
| i S( ( t lower( t value( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyt s t flagst
ask_creates type?t TypesI Type of IPA object (user, group, host, hostgroup, service, netgroup, dns)t valuesu useru groupu hostu serviceu hostgroupu netgroupu dnsrecords memberof?s Member of groups Target members of a groups filter?t Filters' Legal LDAP filter (e.g. ou=Engineering)s subtree?t Subtrees Subtree to apply permissions tos targetgroup?s Target groups" User group to apply permissions toc G sp y | i | d g \ } } Wn# t i j
o | i | n Xd | j o d | d j o t Sn t S( NR t SYSTEM( t get_entryR t NotFoundt handle_not_foundt Falset True( t selft ldapt dnR t entry_attrs( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyt check_system s
c s t f d | i D S( s: Return option dictionary that only includes ACI attributesc 3 s9 x2 | ]+ \ } } | i j o | | f Vq q Wd S( N( t aci_attributes( R R t v( R> ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pys s ( R t items( R> R ( ( R> s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyt filter_aci_attributes s ( u useru groupu hostu serviceu hostgroupu netgroupu dnsrecord( t __name__t
__module__t __doc__R t envt container_permissiont container_dnR t object_namet object_name_pluralt object_classt default_attributesRC t attribute_membersR= t rdn_is_primary_keyR t label_singularR R t takes_paramsRB RF ( ( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyR f sx
t permission_addc B s? e Z e d Z e d Z e i e Z d Z d Z RS( s Add a new permission.s Added permission "%(value)s"c O s | i i | } t | d <| d | d R? R@ RA t
attrs_listR R t optst o( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyt pre_callback s
c
O sP | i i | } t | d <| d | d R? R@ RA R R R^ Ra t attrt et ignore( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyt
post_callback s0
! (
RG RH R RI t msg_summaryt
LDAPCreatet has_output_paramst
output_paramsR` Ri ( ( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyRU s
t permission_add_noacic B so e Z e d Z e d Z e i e Z e Z e
d d e d d d
f Z d Z d Z
d Z RS( s& Add a system permission without an ACIs Added permission "%(value)s"s permissiontype?R s Permission typeR5 u SYSTEMc c s! | i i i d d d d Vd S( NR) R* ( RY R( t clonet None( R> ( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyt get_args
s c c sF x? t t | i D]( } | i | i i j o q n | Vq Wd S( N( t superRn t get_optionsR' RY RC ( R> t option( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyRs s
c O s+ | i d } | o | g | d R? R@ RA R] R R t permission_type( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyR` s ( u SYSTEM( RG RH R RI Rj Rk Rl Rm R= t NO_CLIR t
takes_optionsRq Rs R` ( ( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyRn s
Rc c
B sc e Z e d Z e d Z e i e d d e d d d d g d e d f Z d
Z RS( s Delete a permission.s Deleted permission "%(value)s"t forceR t ForceR2 t no_optiont no_outputR+ s" force delete of SYSTEM permissionsc O s | i d o6 | i i | | | o t i d t d n y! | i i i | d d t Wn t i
j
o n X| S( NRz t infos& A SYSTEM permission may not be removediRW ( Rv RY RB R t ACIErrorR R R[ Re RZ R: ( R> R? R@ R R ( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyR` / s + !( RG RH R RI Rj t
LDAPDeleteRy R R` ( ( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyRc " s t permission_modc B sH e Z e d Z e d Z e i e Z d Z d Z d Z
RS( s Modify a permission.s Modified permission "%(value)s"c O s | i i | | | p t i d t d n y( | i | | d | i i \ } } Wn& t i j
o | i i | n Xd | j o | d o y y t | } | d d Wn+ t
t f j
o } t d | n X| d | d _
| i | | d | i i \ } } t i Wqht i j
o qhXqlt i d d d t d
n | i i | }
t t d t t |
d j oF | d |
d
R? R@ RA R] R R R t new_dnRg R^ R_ ( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyR` D sJ "
$
c O sP | i d j o6 t | t i o t t d } | o d SqF n | d S( Nt update_entryR ( t func_namet
isinstanceR t EmptyModlistt getattrR ( R> R R t exct call_funct call_argst call_kwargsR ( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyt exc_callbackx s
c
O s | d } d | j oT | i i i | d t d | d | i i i | d t d | d | d } n t | d d d g } | i i i | | d } x0 | D]( } | i d
p | | | | R? R@ RA R R R t common_optionsRa t r( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyRi s
( RG RH R RI Rj t
LDAPUpdateRl Rm R` R Ri ( ( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyR > s
4 t permission_findc B s< e Z e d Z e d d d Z e i e Z d Z RS( s Search for permissions.s %(count)d permission matcheds %(count)d permissions matchedi c O s | i d d } | i d t } | p x | D] } | \ } }
yy t | d d g } | i i i |
d d d t | d } x3 | i i D]% }
|
| j o | |
|
|
| D]6 } | \ } }
| d |
d d j o t } PqqW| p t | d d g } | i i i | d | d } | d } | d =| o- | h | | i i i | i i i 6f } n
| | f } | | f | j o/ t | | j o | i | qt } PqqqqW| S( NR t pkey_onlyR R i RW Ra s ACI not found for %st sizelimiti t ipasearchrecordslimitt acinamet truncatedR R@ ( t popRp R< R R R[ t aci_showRZ RY RC R R: t debugt get_ipa_configRF t aci_findR= R R( R' R t append( R> R? t entriesR t argsR R R t entryR@ R R R
Rf t max_entriest configR^ t
aciresultst resultst foundR t new_entry( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyRi sn
&
' (
RG RH R RI R Rj t
LDAPSearchRl Rm Ri ( ( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyR s
R c B s* e Z e d Z e i e Z d Z RS( s' Display information about a permission.c O s yu t | d d g } | i i i | d d t | d } x3 | i i D]% } | | j o | | | | R? R@ RA R R R R
Rf ( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyRi s
&
( RG RH R RI t LDAPRetrieveRl Rm Ri ( ( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyR s
t permission_add_memberc B s e Z d Z e Z RS( s&
Add members to a permission.
( RG RH RI R= Rx ( ( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyR s t permission_remove_memberc B s e Z d Z e Z RS( s+
Remove members from a permission.
( RG RH RI R= Rx ( ( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyR s N($ t ipalib.plugins.baseldapt ipalibR R R R R R t ipalib.requestR R t ipapython.dnR R
RI RZ Rm R t
LDAPObjectR t registerRk RU Rn R Rc R R R R R R t
LDAPAddMemberR t LDAPRemoveMemberR ( ( ( s= /usr/lib/python2.6/site-packages/ipalib/plugins/permission.pyt s>
4
^
6
Y
O