Jump to: navigation, search

V4/Managed Read permissions

Name: V4/Managed Read permissions
Target version: 4.0.0
Incomplete.png Pending review
Last updated: 2016-04-25 by Alich

Note.png
This change is about "Managed Permissions" in general, not just "Read" ones.

Overview

The IPA framework will handle default permissions more robustly with respect to IPA updates and user-made changes.

In the future, this allow us to create a system of fine-grained, user-controllable permissions with good defaults and predictable behavior over upgrades.

Use Cases

Modifications to permissions that come with FreeIPA by default will be restricted to changing the attribute lists and bind types.

For example, attempting to change a default "Modify Users" permission to apply to Groups will fail:

$ ipa permission-mod 'System: Modify Users' --type=group
ipa: ERROR: invalid 'ipapermlocation': not modifiable on managed permissions

So will attempting to make it apply to Read operations:

$ ipa permission-mod 'System: Modify Users' --right=read,
ipa: ERROR: invalid 'ipapermright': not modifiable on managed permissions

On the other hand, making the permission not apply to the "gecos" attribute is possible:

$ ipa permission-mod 'System: Modify Users' --excludedattrs=gecos
------------------------------------------
Modified permission "System: Modify Users"
------------------------------------------
  Permission name: System: Modify Users
  Granted rights: write
  Effective attributes: businesscategory, carlicense, cn, description, displayname, employeetype, facsimiletelephonenumber, givenname, homephone, inetuserhttpurl, initials, l, labeleduri, loginshell, manager, mepmanagedentry, mobile, objectclass, ou, pager, postalcode,
                        preferredlanguage, roomnumber, secretary, seealso, sn, st, street, telephonenumber, title, userclass
  Excluded attributes: gecos
  Default attributes: telephonenumber, cn, labeleduri, manager, street, displayname, homephone, title, facsimiletelephonenumber, loginshell, employeetype, description, businesscategory, preferredlanguage, roomnumber, mepmanagedentry, carlicense, postalcode, givenname,
                      pager, seealso, objectclass, inetuserhttpurl, l, st, mobile, gecos, sn, ou, secretary, userclass, initials
  Bind rule type: permission
  Subtree: cn=users,cn=accounts,dc=idm,dc=lab,dc=eng,dc=brq,dc=redhat,dc=com
  Type: user
  Granted to Privilege: Modify Users and Reset passwords, User Administrators
  Indirect Member of roles: helpdesk, User Administrator

So is changing the bind rule type, i.e. making a permission apply to all authenticated users, anyone including anonymous users, or specific users selected by privileges:

$ ipa permission-mod 'System: Read User Membership' --bindtype=anonymous
--------------------------------------------------
Modified permission "System: Read User Membership"
--------------------------------------------------
  Permission name: System: Read User Membership
  Granted rights: read, compare, search
  Effective attributes: memberof
  Default attributes: memberof
  Bind rule type: anonymous
  Subtree: cn=users,cn=accounts,dc=idm,dc=lab,dc=eng,dc=brq,dc=redhat,dc=com
  Type: user


Documentation draft

This section explains the behavior from the user's point of view:

"Managed" permissions are those permissions that come pre-installed with IPA, and are updated in new releases to cover new functionality. They behave like regular, user-created permissions, with these differences:

  • Their name, location and target can not be modified
  • They cannot be deleted (but note that setting default bindtype and removing from all privileges will effectively disable a permission)
  • They have three sets of attributes:
    • default attributes, managed by IPA, cannot be changed by the user
    • included attributes (--includedattrs in the CLI) are extra attrs that the user has added
    • excluded attributes (--excludedattrs in the CLI) are those that the user has removed

The permission applies to all attributes that appear in either its default or included sets, but not in its excluded set.

It is possible to control the effective attributes using permission-mod's --attrs option, as with other permissions. The modifies the included and excluded lists so that the effective list matches the request.

(Note that attributes of user-created permissions work the same way, but since the default and excluded sets are empty, only the included set determines the effective attributes.)


Newer versions of IPA may add additional attributes to the default set. Attributes added this way should be listed in the corresponding Release Notes. If some of the new attributes are undesirable, add them to the corresponding excluded list before the upgrade.


All managed permissions currently have the "System:" prefix in their name, to prevent naming clashes between user-created permissions and future IPA defaults.


In FreeIPA 4.0, most default permissions have been turned into Managed ones. Some permissions still use the old "SYSTEM" scheme (i.e. they are not modifiable, but may be only assigned to privileges). A list of these permissions follows:

  • Add Automember Rebuild Membership Task
  • Add Replication Agreements
  • Certificate Remove Hold
  • Get Certificates status from the CA
  • Modify DNA Range
  • Modify Replication Agreements
  • Remove Replication Agreements
  • Request Certificate
  • Request Certificates from a different host
  • Retrieve Certificates from the CA
  • Revoke Certificate
  • Write IPA Configuration

Upgrade considerations

When upgrading to IPA 4.0, the process will convert old default permissions, such as.

ipa-3-3$ ipa permission-find 'Modify Groups'
--------------------
1 permission matched
--------------------
  Permission name: Modify Groups
  Permissions: write
  Attributes: cn, description, gidnumber, objectclass, mepmanagedby, ipauniqueid
  Type: group
  Granted to Privilege: Group Administrators
  Indirect Member of roles: User Administrator
----------------------------
Number of entries returned 1
----------------------------

to managed ones, e.g.

$ ipa permission-find 'System: Modify Groups'
--------------------
1 permission matched
--------------------
  Permission name: System: Modify Groups
  Granted rights: write
  Effective attributes: cn, description, gidnumber, ipauniqueid, mepmanagedby, objectclass
  Default attributes: cn, objectclass, mepmanagedby, gidnumber, ipauniqueid, description
  Bind rule type: permission
  Subtree: cn=groups,cn=accounts,dc=idm,dc=lab,dc=eng,dc=brq,dc=redhat,dc=com
  Type: group
  Granted to Privilege: Group Administrators
  Indirect Member of roles: User Administrator
----------------------------
Number of entries returned 1
----------------------------

If the default permissions that come with IPA have been modified, special care should be taken when upgrading.

Removed default permissions

If a default permission was removed, the upgrade process will simply create a new default permission. This is consistent with to how all IPA upgrades work.

Changed attribute lists

If only the attribute list differs from a past default, the permission updater will set the included/excluded lists of the new default permission to match the modifications.

Note that the updater considers default values from all past IPA versions. Be sure to check the result after updating.

Other ACI changes

If any other changes were made to a default permission, the updater emits a warning and does not create the new permission. In this case, there are two options:

1) Delete the old permission (e.g. ipa permission-del 'Modify Groups'), then run ipa-ldap-updater -p. This will create the new default permission.

2) Change the old permission to a new-style (V2) permission by issuing e.g. ipa permission-mod 'Modify Groups' on a server with IPA 4.0+, then run ipa-ldap-updater -p. This will also create the new default permission, but the old one will be preserved as a user-created permission.


The problem

Currently, updates to permissions that come with IPA are specified in .update files.

This approach has the disadvantage that if the user modifies the permission, the updater will not recognize it, so it will end up not being updated. This may result in reduced functionality (if needed attributes are not added), or security issues (if attributes are not deleted).


Design

Managed Permissions

V2 permissions with the MANAGED flag set are called Managed permissions.

These permissions grant access to a set of attributes defined by IPA and kept up-to-date on upgrades, while allowing users to add or remove specific attributes from the default list.

The user can also manage the bind rule and privilege membership of Managed permissions.

The other aspects of Managed permissions (name, location, target) are not modifiable by the user. The user cannot manually add new Managed permissions, or delete existing ones (unless --force is applied; but later we may restrict this via ACIs).

To ensure that installing low-version replicas or disabling plugins does not revoke access to existing data, the default list of attributes will be kept in LDAP as ipaPermDefaultAttr. Users can not modify this list via the framework. On updates, new attributes will only be added to this list. (To remove attributes, we would need to write a separate update plugin.)

There will be two attribute types for holding attributes the admin added and removed: ipaPermIncludedAttr and ipaPermExcludedAttr respectively. (In user-created permissions, ipaPermIncludedAttr is used for the same purpose as here, and excluded & default are empty.) See V3/Permissions V2 for the schema definition.

When generating the ACI, the resulting attribute list will be computed by taking the ipaPermDefaultAttr set, adding any ipaPermIncludedAttrs, and then removing any ipaPermExcludedAttrs.

For example, this permission:

dn: cn=Read Users,cn=permissions,cn=pbac,$SUFFIX
cn: Read Users
ipaPermDefaultAttr: cn
ipaPermDefaultAttr: sn
ipaPermDefaultAttr: givenName
ipaPermDefaultAttr: l
...
ipaPermIncludedAttr: favoriteColor
ipaPermExcludedAttr: givenName
objectClass: top
objectClass: groupOfNames
objectclass: ipaPermission
objectclass: ipaManagedPermission
ipaPermType: SYSTEM
ipaPermType: V2
ipaPermType: MANAGED
ipaPermLocation: cn=users,cn=accounts,$SUFFIX
ipaPermRight: read
ipaPermTarget: uid=*,cn=users,cn=accounts,$SUFFIX
ipaPermBindRuleType: permission

would allow users to read all default user attributes except givenName, plus additionally favoriteColor.

CLI & API

The permission-{mod,find} commands will gain two new options, --includedattrs (API: ipapermincludedattr) and --excludedattrs (API: ipapermexcludedattr). For permission-mod it is an error to use --excludedattrs with non-managed permissions.

For a managed permission, the permission-{mod,find,show} commands will output all three lists (ipapermdefaultattr, ipapermallowedattr, ipapermexcludedattr), as well as the computed list of effective attributes.

For a non-managed permission, permission-{mod,find,show} will only output the effective attributes (attrs). With --all, the included attributes will also be included. As any missing attribute course excluded and default will not be output. With --raw, only ipaPermIncludedAttr, and not attrs, wil be output.

It is an error to set the ipapermlocation, ipapermtargetfilter, or ipapermtarget of a managed permission. (This means that it's an error to ise the API options subtree, extratargetfilter, target, memberof, targetgroup, or type with a managed permission.)

Default Permission Updater

A server post-update plugin will walk through ipalib Object plugins and create/update managed permissions pertaining to them.

Names of such default permissions are required to start with "System: ", so that default permissions added in future IPA releases do not conflict with user-created permissions. The ":" character will not be usable in permission-add. (It will be usable in permission-mod and permission-del, where managed permissions are subject to the limitations stated above.)

The IPA Object plugins will gain a new Python attribute, managed_permissions, which will hold a template for the permissions that are to be added by default to manage that object.

This will allow plugins to be more self-contained; it will no longer be necessary to modify IPA's update files to add the common cases of plugin-specific permissions.

The format of the managed_permissions templates will be documented in the update_managed_permissions server plugin (link).

Replacing legacy default permissions

Another entry in the managed_permissionstemplate, replaces, will be used for replacing legacy permissions with new managed ones. Example:

   managed_permissions = {
       'ipa:Modify SUDO Rule': {
           'ipapermbindruletype': 'permission',
           'ipapermright': {'write'},
           'ipapermdefaultattr': {
               'description', 'ipaenabledflag', 'usercategory',
               'hostcategory', 'cmdcategory', 'ipasudorunasusercategory',
               'ipasudorunasgroupcategory', 'externaluser',
               'ipasudorunasextuser', 'ipasudorunasextgroup', 'memberdenycmd',
               'memberallowcmd', 'memberuser'
           },
           'replaces': [
               '(targetattr = "description || ipaenabledflag || usercategory || hostcategory || cmdcategory || ipasudorunasusercategory || ipasudorunasgroupcategory || externaluser || ipasudorunasextuser || ipasudorunasextgroup || memberdenycmd || memberallowcmd || memberuser")(target = "ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Modify Sudo rule";allow (write) groupdn = "ldap:///cn=Modify Sudo rule,cn=permissions,cn=pbac,$SUFFIX";)',
           }
       },
       ...

If the an existing legacy (i.e. non-v2) permission exists either without an associated ACI or with an ACI that exactly matches the information specified in the replaces list, the old permission is removed after the new one is added.

This ensures that

  • the old permission is retained if the user has changed it
  • at no time are the ACIs revoked (briefly, there are two ACIs granting the same access).

If an existing legacy permission does match cn but not some other attributes in the replaces dict, a warning is logged, the new permission is added, and the old one is left in place.

The exception are attributes. If the ACI only differs in the list of attributes, the permission is upgraded as notmal but with ipapermincludedattr and ipapermexcludedattr set to reflect the difference between the old default and the pre-existing permission.

Removing the global anonymous read ACI

After the permission updater successfully runs, it will look for an ACI named "Enable Anonymous access" in $SUFFIX, and remove it.

The update_anonymous_aci server update plugin will be removed.


ACI.txt

To ensure that permission changes are properly reviewed, a summary file similar to API.txt will be generated, and it will be checked on each build.

It will contain a summary of the default managed permissions.

A makeaci script similar to makeapi will be provided and called to check the file on each build.

Implementation

No additional requirements or changes discovered during the implementation phase.

Feature Managment

UI

The immutable aspects of Managed permissions are grayed out in the Web UI.

CLI

See the CLI & API section in Design.

Major configuration options and enablement

Access control is configured via the existing RBAC system.

Replication

N/A, ACIs and permissions are replicated.

Updates and Upgrades

Old servers will not be able to modify Managed permissions, except adding/removing them to/from prigileges. Details are in Permissions V2, which will be implemented in the same release. Managed permissions use the MANAGED flag.

Installations with customized ACIs will need some extra care when upgrading, as detailed in Upgrade considerations above. (But note that IPA's upgrade behavior wrt modified default permissions has always been underspecified and likely surprising.)


Dependencies

No new package and library dependencies.

External Impact

Tests and documentation need to be written.

Backup and Restore

ACIs, permissions, privileges and roles are already included in backup & restore.

Test Plan

Test managed permissions

Implemented in ipatests.test_xmlrpc.test_permission_plugin.test_managed_permissions

Like other tests in the test_xmlrpc suite, these tests should run on a clean IPA installation, or possibly after other similar tests.


First, create a managed permission entry as follows:

dn: cn=testperm,cn=permissions,cn=pbac,$SUFFIX
cn: testperm
ipaPermBindRuleType: permission
ipaPermDefaultAttr: cn
ipaPermDefaultAttr: l
ipaPermDefaultAttr: o
ipaPermLocation: cn=users,cn=accounts,$SUFFIX
ipaPermRight: write
ipaPermTarget: uid=*,cn=users,cn=accounts,$SUFFIX
ipaPermissionType: SYSTEM
ipaPermissionType: V2
ipaPermissionType: MANAGED
objectClass: groupofnames
objectClass: ipapermission
objectClass: ipapermissionv2
objectClass: top

This corresponds to ipa permission-add permission1 --type=user permissions=write, with added ipaPermissionType of MANAGED, and ipaPermDefaultAttr of cn, l, and o.

Also create the corresponding ACI at cn=users,cn=accounts,$SUFFIX:

(targetattr = "cn || l || o")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:testperm";allow (write) groupdn = "ldap:///cn=testperm,cn=permissions,cn=pbac,$SUFFIX";)

The first two tests check that this preparation was successful.

Test case: Show pre-created u'testperm'

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_show testperm --all

Expected results

The command succeeds with this output:

  dn: cn=testperm,cn=permissions,cn=pbac,$SUFFIX
  Permission name: testperm
  Permissions: write
  Effective attributes: l, o, cn
  Bind rule type: permission
  Subtree: cn=users,cn=accounts,$SUFFIX
  ACI target DN: uid=*,cn=users,cn=accounts,$SUFFIX
  Type: user
  Default attributes: l, o, cn
  ipapermissiontype: SYSTEM, V2, MANAGED
  objectclass: groupofnames, ipapermission, top, ipapermissionv2


Test case: Verify ACI of testperm

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Search for ACI named permission:testperm in cn=users,cn=accounts,$SUFFIX

Expected results

The following ACI is found:

(targetattr = "cn || l || o")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:testperm";allow (write) groupdn = "ldap:///cn=testperm,cn=permissions,cn=pbac,$SUFFIX";)


Test case: Try to modify ipapermlocation in u'testperm'

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_mod testperm --subtree='cn=users,cn=accounts,$SUFFIX'

Expected results

The command fails with this error:

invalid 'ipapermlocation': not modifiable on managed permissions


Test case: Try to modify ipapermright in u'testperm'

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_mod testperm --permissions=compare

Expected results

The command fails with this error:

invalid 'ipapermright': not modifiable on managed permissions


Test case: Try to modify ipapermtarget in u'testperm'

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_mod testperm --target='cn=users,cn=accounts,$SUFFIX'

Expected results

The command fails with this error:

invalid 'ipapermtarget': not modifiable on managed permissions


Test case: Try to modify ipapermtargetfilter in u'testperm'

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_mod testperm --filter='(ou=engineering)'

Expected results

The command fails with this error:

invalid 'ipapermtargetfilter': not modifiable on managed permissions


Test case: Try to modify memberof in u'testperm'

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_mod testperm --memberof=admins

Expected results

The command fails with this error:

invalid 'ipapermtargetfilter': not modifiable on managed permissions


Test case: Try to modify targetgroup in u'testperm'

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_mod testperm --targetgroup=admins

Expected results

The command fails with this error:

invalid 'ipapermtarget': not modifiable on managed permissions


Test case: Try to modify type in u'testperm'

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_mod testperm --type=group

Expected results

The command fails with this error:

invalid 'ipapermlocation': not modifiable on managed permissions


Test case: Try to rename u'testperm'

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_mod testperm --rename=testperm2

Expected results

The command fails with this error:

invalid 'rename': cannot rename managed permissions


Test case: Verify ACI of testperm

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Search for ACI named permission:testperm in cn=users,cn=accounts,$SUFFIX

Expected results

The following ACI is found:

(targetattr = "cn || l || o")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:testperm";allow (write) groupdn = "ldap:///cn=testperm,cn=permissions,cn=pbac,$SUFFIX";)



Test case: Modify included and excluded attrs in u'testperm'

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_mod testperm --all --includedattrs=dc --excludedattrs=cn

Expected results

The command succeeds with this output:

------------------------------
Modified permission "testperm"
------------------------------
  dn: cn=testperm,cn=permissions,cn=pbac,$SUFFIX
  Permission name: testperm
  Permissions: write
  Effective attributes: l, o, dc
  Excluded attributes: cn
  Included attributes: dc
  Bind rule type: permission
  Subtree: cn=users,cn=accounts,$SUFFIX
  ACI target DN: uid=*,cn=users,cn=accounts,$SUFFIX
  Type: user
  Default attributes: l, o, cn
  ipapermissiontype: SYSTEM, V2, MANAGED
  objectclass: groupofnames, ipapermission, top, ipapermissionv2


Test case: Verify ACI of testperm

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Search for ACI named permission:testperm in cn=users,cn=accounts,$SUFFIX

Expected results

The following ACI is found:

(targetattr = "dc || l || o")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:testperm";allow (write) groupdn = "ldap:///cn=testperm,cn=permissions,cn=pbac,$SUFFIX";)



Test case: Modify included attrs in u'testperm'

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_mod testperm --all --includedattrs={cn,sn}

Expected results

The command succeeds with this output:

------------------------------
Modified permission "testperm"
------------------------------
  dn: cn=testperm,cn=permissions,cn=pbac,$SUFFIX
  Permission name: testperm
  Permissions: write
  Effective attributes: l, o, sn
  Excluded attributes: cn
  Included attributes: cn, sn
  Bind rule type: permission
  Subtree: cn=users,cn=accounts,$SUFFIX
  ACI target DN: uid=*,cn=users,cn=accounts,$SUFFIX
  Type: user
  Default attributes: l, o, cn
  ipapermissiontype: SYSTEM, V2, MANAGED
  objectclass: groupofnames, ipapermission, top, ipapermissionv2


Test case: Verify ACI of testperm

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Search for ACI named permission:testperm in cn=users,cn=accounts,$SUFFIX

Expected results

The following ACI is found:

(targetattr = "l || o || sn")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:testperm";allow (write) groupdn = "ldap:///cn=testperm,cn=permissions,cn=pbac,$SUFFIX";)



Test case: Add ineffective included attr to u'testperm'

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_mod testperm --all --includedattrs={cn,sn,o}

Expected results

The command succeeds with this output:

------------------------------
Modified permission "testperm"
------------------------------
  dn: cn=testperm,cn=permissions,cn=pbac,$SUFFIX
  Permission name: testperm
  Permissions: write
  Effective attributes: l, o, sn
  Excluded attributes: cn
  Included attributes: cn, sn, o
  Bind rule type: permission
  Subtree: cn=users,cn=accounts,$SUFFIX
  ACI target DN: uid=*,cn=users,cn=accounts,$SUFFIX
  Type: user
  Default attributes: l, o, cn
  ipapermissiontype: SYSTEM, V2, MANAGED
  objectclass: groupofnames, ipapermission, top, ipapermissionv2


Test case: Verify ACI of testperm

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Search for ACI named permission:testperm in cn=users,cn=accounts,$SUFFIX

Expected results

The following ACI is found:

(targetattr = "l || o || sn")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:testperm";allow (write) groupdn = "ldap:///cn=testperm,cn=permissions,cn=pbac,$SUFFIX";)



Test case: Modify excluded attrs in u'testperm'

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_mod testperm --all --excludedattrs={cn,sn}

Expected results

The command succeeds with this output:

------------------------------
Modified permission "testperm"
------------------------------
  dn: cn=testperm,cn=permissions,cn=pbac,$SUFFIX
  Permission name: testperm
  Permissions: write
  Effective attributes: l, o
  Excluded attributes: cn, sn
  Included attributes: cn, sn, o
  Bind rule type: permission
  Subtree: cn=users,cn=accounts,$SUFFIX
  ACI target DN: uid=*,cn=users,cn=accounts,$SUFFIX
  Type: user
  Default attributes: l, o, cn
  ipapermissiontype: SYSTEM, V2, MANAGED
  objectclass: groupofnames, ipapermission, top, ipapermissionv2


Test case: Verify ACI of testperm

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Search for ACI named permission:testperm in cn=users,cn=accounts,$SUFFIX

Expected results

The following ACI is found:

(targetattr = "l || o")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:testperm";allow (write) groupdn = "ldap:///cn=testperm,cn=permissions,cn=pbac,$SUFFIX";)



Test case: Modify bind rule in u'testperm'

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_mod testperm --bindtype=all

Expected results

The command succeeds with this output:

------------------------------
Modified permission "testperm"
------------------------------
  Permission name: testperm
  Permissions: write
  Effective attributes: l, o
  Excluded attributes: cn, sn
  Included attributes: cn, sn, o
  Bind rule type: all
  Subtree: cn=users,cn=accounts,$SUFFIX
  ACI target DN: uid=*,cn=users,cn=accounts,$SUFFIX
  Type: user
  Default attributes: l, o, cn


Test case: Verify ACI of testperm

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Search for ACI named permission:testperm in cn=users,cn=accounts,$SUFFIX

Expected results

The following ACI is found:

(targetattr = "l || o")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:testperm";allow (write) userdn = "ldap:///all";)



Test case: Show u'testperm' with no options

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_show testperm

Expected results

The command succeeds with this output:

  Permission name: testperm
  Permissions: write
  Effective attributes: l, o
  Excluded attributes: cn, sn
  Included attributes: cn, sn, o
  Bind rule type: all
  Subtree: cn=users,cn=accounts,$SUFFIX
  ACI target DN: uid=*,cn=users,cn=accounts,$SUFFIX
  Type: user
  Default attributes: l, o, cn


Test case: Show u'testperm' with --all

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_show testperm --all

Expected results

The command succeeds with this output:

  dn: cn=testperm,cn=permissions,cn=pbac,$SUFFIX
  Permission name: testperm
  Permissions: write
  Effective attributes: l, o
  Excluded attributes: cn, sn
  Included attributes: cn, sn, o
  Bind rule type: all
  Subtree: cn=users,cn=accounts,$SUFFIX
  ACI target DN: uid=*,cn=users,cn=accounts,$SUFFIX
  Type: user
  Default attributes: l, o, cn
  ipapermissiontype: SYSTEM, V2, MANAGED
  objectclass: groupofnames, ipapermission, top, ipapermissionv2


Test case: Show u'testperm' with --raw

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_show testperm --raw

Expected results

The command succeeds with this output:

  cn: testperm
  ipapermright: write
  ipapermexcludedattr: cn
  ipapermexcludedattr: sn
  ipapermincludedattr: cn
  ipapermincludedattr: sn
  ipapermincludedattr: o
  ipapermbindruletype: all
  ipapermlocation: cn=users,cn=accounts,$SUFFIX
  ipapermtarget: uid=*,cn=users,cn=accounts,$SUFFIX
  aci: (targetattr = "l


Test case: Modify attrs of u'testperm' to normalize

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_mod testperm --attrs={l,o}

Expected results

The command succeeds with this output:

------------------------------
Modified permission "testperm"
------------------------------
  Permission name: testperm
  Permissions: write
  Effective attributes: l, o
  Excluded attributes: cn
  Bind rule type: all
  Subtree: cn=users,cn=accounts,$SUFFIX
  ACI target DN: uid=*,cn=users,cn=accounts,$SUFFIX
  Type: user
  Default attributes: l, o, cn


Test case: Verify ACI of testperm

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Search for ACI named permission:testperm in cn=users,cn=accounts,$SUFFIX

Expected results

The following ACI is found:

(targetattr = "l || o")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:testperm";allow (write) userdn = "ldap:///all";)



Test case: Modify attrs of u'testperm' to add sn

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_mod testperm --attrs={l,o,sn}

Expected results

The command succeeds with this output:

------------------------------
Modified permission "testperm"
------------------------------
  Permission name: testperm
  Permissions: write
  Effective attributes: l, o, sn
  Excluded attributes: cn
  Included attributes: sn
  Bind rule type: all
  Subtree: cn=users,cn=accounts,$SUFFIX
  ACI target DN: uid=*,cn=users,cn=accounts,$SUFFIX
  Type: user
  Default attributes: l, o, cn


Test case: Verify ACI of testperm

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Search for ACI named permission:testperm in cn=users,cn=accounts,$SUFFIX

Expected results

The following ACI is found:

(targetattr = "l || o || sn")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:testperm";allow (write) userdn = "ldap:///all";)



Test case: Modify attrs of u'testperm' to allow cn again

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_mod testperm --attrs={l,o,sn,cn}

Expected results

The command succeeds with this output:

------------------------------
Modified permission "testperm"
------------------------------
  Permission name: testperm
  Permissions: write
  Effective attributes: l, o, sn, cn
  Included attributes: sn
  Bind rule type: all
  Subtree: cn=users,cn=accounts,$SUFFIX
  ACI target DN: uid=*,cn=users,cn=accounts,$SUFFIX
  Type: user
  Default attributes: l, o, cn


Test case: Verify ACI of testperm

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Search for ACI named permission:testperm in cn=users,cn=accounts,$SUFFIX

Expected results

The following ACI is found:

(targetattr = "cn || l || o || sn")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:testperm";allow (write) userdn = "ldap:///all";)



Test case: Try to delete u'testperm'

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_del testperm

Expected results

The command fails with this error:

Insufficient access: cannot delete managed permissions


Test case: Delete u'testperm' with --force

Autotest

{{{autotest}}}

Setup

See beginning of the Tests section

Actions

Run the following command:

ipa permission_del testperm --force

Expected results

The command succeeds with this output:

-----------------------------
Deleted permission "testperm"
-----------------------------

Cleanup

ipa permission_del testperm --force
ipa permission_del testperm2 --force

RFE Author

Petr Viktorin