On 02/25/2014 07:24 AM, thierry bordaz wrote:
> On 02/24/2014 10:47 PM, Noriko Hosoi wrote:
>> Rich Megginson wrote:
>>> On 02/24/2014 09:00 AM, thierry bordaz wrote:
>>>> Hello,
>>>>
>>>> IPA team filled this ticket
>>>>
https://fedorahosted.org/389/ticket/47553.
>>>>
>>>> It requires an ACI improvement so that during a MODDN a given
>>>> user is only allowed to move an entry from one specified part
>>>> of the DIT to an other specified part of the DIT. This without
>>>> the need to grant the ADD permission.
>>>>
>>>> Here is the design of what could be implemented to support
>>>> this need
>>>>
http://port389.org/wiki/Access_control_on_trees_specified_in_MODDN_operation
>>>>
>>>> regards
>>>> thierry
>>>>
>>>
>>> Since this not related to any Red Hat internal or customer
>>> information, we should move this discussion to the 389-devel list.
>>>
>> Hi Thierry,
>>
>> Your design looks good. A minor question. The doc does not mention
>> about "deny". For instance, in your example DIT, can I allow
>> "moddn_to" and "moddn_from" on the top
"dc=example,dc=com" and deny
>> them on "cn=tests". Then, I can move an entry between cn=accounts
>> and staging, but not to/from cn=tests? Or "deny" is not supposed to
>> use there?
>>
>> Thanks,
>> --noriko
>
> Hi Noriko,
>
> Thanks for having looked at the document. You are right, I missed to
> document how 'DENY' aci would work.
>
> I updated the design
>
http://port389.org/wiki/Access_control_on_trees_specified_in_MODDN_operat...
> to indicate how a DENY rights could be used.
>
> By default if there is no ACI granting 'allow', the operation is
> rejected. So in that case, without ACI applicable on 'cn=tests',
> MODDN to/from 'cn=tests' will not be authorized.
> Adding a DENY to target 'cn=tests' would also work but I think it is
> not required.
>
> In the example I added, the 'ALLOW' right is granted to a tree
> (cn=accounts,SUFFIX) except to a subtree of it
> (cn=except,cn=accounts,SUFFIX)
So in order to do a MODDN operation, you need both the moddn_from aci
and moddn_to aci?
For example:
dn: dc=example,dc=com
aci: (target="ldap:///cn=staging,dc=example,dc=com")(version 3.0; acl
"MODDN from"; allow (moddn_from))
userdn="ldap:///uid=admin_accounts,dc=example,dc=com" ;)
If I only have this aci, will it allow anything? That is, if I don't
have a (moddn_to) aci somewhere, will this (moddn_from) aci allow me
to move anything?
Yes it will allow you to do a MODDN if you are granted the 'ADD' right
on the new superior entry.
I think this double ACI can be an issue as freeipa was hoping to use a
single ACI. But I have not found a solution to grant move (to/from) in a
single aci syntax.
>
> regards
> thierry
>>
>>
>>
>>
>> --
>> 389-devel mailing list
>> 389-devel(a)lists.fedoraproject.org
>>
https://admin.fedoraproject.org/mailman/listinfo/389-devel
>
>
>
> --
> 389-devel mailing list
> 389-devel(a)lists.fedoraproject.org
>
https://admin.fedoraproject.org/mailman/listinfo/389-devel
--
389-devel mailing list
389-devel(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-devel