On 08/13/2009 02:32 PM, Paul Company wrote:
All users that need access /must/ be in the file, else they default to read-only.
Users in the file should either be in the admin group or some other group.
    

I think this is my problem.
The default behavior is "read-only for everything".
What I want is the default behavior to be "FULL access to Systems,
read-only for everything else".

Is there a way to do this?
Hack some python file?
  

Yeah.   That will do.

I'd make a authz_pcompany and stick that in site-packages/cobbler/modules, and teach it to do what you want.


There's only a small group of people that I want to give FULL access
to everything.
But there is a very large group of people (hundreds of them) that only
need FULL access to Systems. I don't want to manage this large group
manually via the users.conf file.

Seems like the ACL method would work, but it seems like the ACL method
doesn't work,
or is not supported, etc.



  

Yeah, it might work a little, but it was designed for field level access control, and is something we never really finished up.

Hope that helps!




On Thu, Aug 13, 2009 at 10:28 AM, Michael DeHaan<mdehaan@redhat.com> wrote:
  
On 08/13/2009 01:15 PM, Paul Company wrote:

>From authz_ownership.py:

    # everybody can get read-only access to everything
    # if they pass authorization, they don't have to be in users.conf


We're miscommunicating again.
I think I should have said,
"I want those who aren't in users.conf to have FULL access to Systems,
but that's it."

Not read-only access, but FULL access to systems.
I want read-only access to everything else for them.



Hmm, I do have things mixed up.

All users that need access /must/ be in the file, else they default to
read-only.    Users in the file should either be in the admin group or some
other group.

It's still true that users can only access objects for which they are in the
ownership list.

Users that create objects should automatically have those objects assigned
to themselves.

This is best understood by reading authz_ownership.py -- it was written for
the requirements of a few users and is probably not perfect for all use
cases, and I'm all for revisiting it and doing something that more people
would prefer for future releases.

See
http://github.com/mpdehaan/cobbler/blob/61942deebfe341ea150b4e4c143d4d8126755646/cobbler/modules/authz_ownership.py







On Thu, Aug 13, 2009 at 10:08 AM, Michael DeHaan<mdehaan@redhat.com> wrote:


On 08/13/2009 01:01 PM, Paul Company wrote:

That's because it doesn't exist in user.conf :)


It is in user.conf, you're reading the wrong example.
Read the first thread in the post.
There's two examples (one that works, one that does not).
pcompany@EXAMPLE.COM is in the second example.
You referenced the first example.


Ok.



Hence you have to edit the Apache file to reject users not in your ok list
as well.


I'm confused again.
Why would I do that?
I want all valid Kerberos users to succeed logging in.


Then you would not do that in your own personal case.

An example if your are using the (for example) @redhat.com kerberos and you
only want people in a department
to access the server.    Authn_passthru will admit anyone cleared by Apache,
regardless of how Apache is configured.

For instance, if you were using authz_allowall you almost certaintly would
want to do this, and in most cases you'd also what to do this with
authz_ownership, because you didn't want the universe to create objects.
This is a site-specific security decision.

Anyway, users.conf is for mapping users to groups for ownership flagging
purposes.   That is basically it.

Ownership works on an object by object basis.


I want those who aren't in users.conf to have access to Systems, but that's
it.
I want those who *are* in uses.conf (specifically the admins group) to
have full access.


Can that be done?



Yes.

>From authz_ownership.py:

    # everybody can get read-only access to everything
    # if they pass authorization, they don't have to be in users.conf



On Thu, Aug 13, 2009 at 9:31 AM, Michael DeHaan<mdehaan@redhat.com> wrote:


On 08/13/2009 12:23 PM, Paul Company wrote:

Guessing -- I believe your username in the bottom example is
pcompany@EXAMPLE.com,
if that's what you logged in with, not pcompany.

Was that it?


No, I can login as pcompany or pcompany@EXAMPLE.COM and neither works!

It has something to do with the httpd stanza.
If you diff the stanzas,

This works:
 AuthType Basic
 AuthName Cobbler

This does not:
 AuthType Kerberos
 AuthName "Kerberos Login"
 KrbServiceName HTTP
 Krb5Keytab /etc/httpd/conf.d/HTTP.keytab
 KrbAuthRealms EXAMPLE.COM

I'm assuming the authz_ownership module receives the username from
somewhere and checks it against the user.conf file.
What passes the username to the authz_ownership module?


The username is the username you give to the login prompt.

And how do I debug that?
It's acting like pcompany@EXAMPLE.COM does not exist in user.conf.


That's because it doesn't exist in user.conf :)



# vi /etc/cobbler/users.conf
[admins]
admin = ""
cobbler = ""
pcompany = ""
:wq!



You will be able to login through anything Kerberos allows, though what you
are able to do is governed by users.conf.

Hence you have to edit the Apache file to reject users not in your ok list
as well.

--Michael






_______________________________________________
cobbler mailing list
cobbler@lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/cobbler




_______________________________________________
cobbler mailing list
cobbler@lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/cobbler


_______________________________________________
cobbler mailing list
cobbler@lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/cobbler




_______________________________________________
cobbler mailing list
cobbler@lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/cobbler


_______________________________________________
cobbler mailing list
cobbler@lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/cobbler


    
_______________________________________________
cobbler mailing list
cobbler@lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/cobbler