--- Francis Augusto Medeiros-Logeay Oslo, Norway

On 2023-11-13 22:18, Rob Crittenden via FreeIPA-users wrote:

Francis Augusto Medeiros-Logeay via FreeIPA-users wrote:

...

Hi,

As I mentioned earlier, I am creating a plugin. My plugin creates the following container:

# postfixadmin, mailserver, etc, ipa.test dn: cn=postfixadmin,cn=mailserver,cn=etc,dc=ipa,dc=test objectClass: top objectClass: nsContainer cn: postfixadmin

Domain entries are like this:

# ipa.test, postfixadmin, mailserver, etc, ipa.test dn: cn=ipa.test,cn=postfixadmin,cn=mailserver,cn=etc,dc=ipa,dc=test cn: ipa.test objectClass: postfixDomain objectClass: nsContainer objectClass: top

Mailboxes are under a domain:

# francis, ipa.test, postfixadmin, mailserver, etc, ipa.test dn: uid=francis,cn=ipa.test,cn=postfixadmin,cn=mailserver,cn=etc,dc=ipa,dc=te st uid: francis givenName: francis sn: Medeiros-Logeay objectClass: postfixMailbox objectClass: person objectClass: inetOrgPerson objectClass: inetUser objectClass: top objectClass: organizationalPerson cn: francis Medeiros-Logeay postfixMailAddress: francis@ipa.test status: TRUE

And finally aliases:

# testing, ipa.test, postfixadmin, mailserver, etc, ipa.test dn: uid=testing,cn=ipa.test,cn=postfixadmin,cn=mailserver,cn=etc,dc=ipa,dc=te st uid: testing postfixMailDestination: francis@ipa.test status: FALSE objectClass: postfixAlias objectClass: top postfixMailAlias: testing@ipa.test

However, when using ldapsearch with a system user and using cn=postfixadmin,cn=mailserver,cn=etc,$SUFFIX, I only get the top container and the domain. I don’t get any of the other entries. Doing the same with an admin gives me all the entries below the mentioned DN.

I am confused about permissions, so I tried to add this to the class «Alias» on my plugin code:

managed_permissions = { 'System: Read Mail Data': { 'ipapermlocation': DN(('cn', 'postfixadmin'), ('cn', 'mailserver'), ('cn', 'etc')), 'ipapermbindruletype': 'annonymous', 'ipapermtarget': DN(('cn', 'postfixadmin'), ('cn', 'mailserver'), ('cn', 'etc')), 'replaces_global_anonymous_aci': True, 'ipapermright': {'read', 'search', 'compare'}, 'ipapermdefaultattr': { 'cn', 'objectclass', 'postfixMailAlias', 'postfixMailDestination','uid','dn' } } }

It doesn’t seem to help.

I also added an attribute to my users, called «postfixMailAddress». That attribute is also not visible to my system user, despite having added this to my code:

user.managed_permissions = {**user.managed_permissions, **{ 'System: Read User Mail Attributes': { 'ipapermbindruletype': 'all ', 'ipapermright': {'read', 'search', 'compare'}, 'ipapermdefaultattr': { 'postfixMailAddress', 'status', 'mailquota' }, 'System: Modify User Mail Attributes': { 'ipapermbindruletype': 'permission', 'ipapermright': {'write', 'add', 'delete'}, 'ipapermdefaultattr': { 'postfixMailAddress', 'status', 'mailquota' } } }}}

I’d love if someone could please point me to the right direction to manage these permissions so that my binding user can see attributes and entries.

The underlying acis are likely not created yet. Run ipa-server-upgrade which should create them.

Thanks a lot Rob. It worked for the user attribute (postfixMailAddress). But the entries under cn=postfixadmin,cn=mailserver,cn=etc aren't visible for the binding user. is there anything wrong with the code?

Best, Francis

On Nov 14, 2023, at 07:39, Christian Heimes via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:

I noticed that your plugin creates a bunch of managed permissions, but has no update code to wire them to privileges and roles. You have to add your permissions to a privilege, either with "default_privileges" in the managed permission or manually with an LDAP update. My code has some examples:

https://github.com/podengo-project/ipa-hcc/blob/4a3998191099ef062fe54d7e1ca6...

Thanks a lot for your answer.

I am a bit confused here. What should be an appropriate default_privileges value so that a system account can read all the entries/attributes below cn=mailserver,cn=etc?

I noticed that your 75-mailserver.update has a bug. You are not assigning a value to the RDN "cn" attribute. You want:

dn: cn=mailserver,cn=etc,$SUFFIX default: objectclass: top default: objectclass: nsContainer only: cn: mailserver

Thank you Christian. Does it mean that the cn=postfixadmin,cn=mailserver,cn=etc,$SUFFIX also needs an «only» statement?

Also you are creating new objects for default attributes and managed permissions. Instead you should extend / update the existing objects:

user.default_attributes.extend(['alias', ...]) user.managed_permissions.update( { 'System: Read User Mail Attributes': {...}, } )

Thanks!

-- Christian Heimes Principal Software Engineer, Identity Management and Platform Security

Red Hat GmbH, https://de.redhat.com/ , Registered seat: Grasbrunn, Commercial register: Amtsgericht Muenchen, HRB 153243, Managing Directors: Charles Cachera, Brian Klemm, Laurie Krebs, Michael O'Neill _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

On Nov 14, 2023, at 09:14, Christian Heimes via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:

On 14/11/2023 08.48, Francis Augusto Medeiros-Logeay via FreeIPA-users wrote:

...

...

On Nov 14, 2023, at 07:39, Christian Heimes via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:

I noticed that your plugin creates a bunch of managed permissions, but has no update code to wire them to privileges and roles. You have to add your permissions to a privilege, either with "default_privileges" in the managed permission or manually with an LDAP update. My code has some examples:

https://github.com/podengo-project/ipa-hcc/blob/4a3998191099ef062fe54d7e1ca6...

Thanks a lot for your answer. I am a bit confused here. What should be an appropriate default_privileges value so that a system account can read all the entries/attributes below cn=mailserver,cn=etc?

Who should be allowed to access the fields? All principals (users, services, hosts, sys accounts) or a limited subset of principals?

Any authenticated user. I have this system account cn=system,cn=sysaccounts,cn=etc that I use for reading only attributes, That entry do’esnt see any entry (besides postfixDomain object classes) under the tree we mention.

...

Thank you Christian. Does it mean that the cn=postfixadmin,cn=mailserver,cn=etc,$SUFFIX also needs an «only» statement?

Yes, you need to create the RDN attribute for all entries, either with "only" or "default".

Thanks! What’s the difference between only and default, since we’re here? :)

Best,

Francis

On 14/11/2023 09.18, Francis Augusto Medeiros-Logeay via FreeIPA-users wrote:

...

...

I am a bit confused here. What should be an appropriate default_privileges value so that a system account can read all the entries/attributes below cn=mailserver,cn=etc?

Who should be allowed to access the fields? All principals (users, services, hosts, sys accounts) or a limited subset of principals?

Any authenticated user. I have this system account cn=system,cn=sysaccounts,cn=etc that I use for reading only attributes, That entry do’esnt see any entry (besides postfixDomain object classes) under the tree we mention.

If any authenticated principal should be allowed to read the entries, then you do not need a named permission. The bind rule type "all" creates an ACI with target "ldap:///all" (all authenticated users). Easier to maintain and faster to check.

...

...

Thank you Christian. Does it mean that the cn=postfixadmin,cn=mailserver,cn=etc,$SUFFIX also needs an «only» statement?

...

Yes, you need to create the RDN attribute for all entries, either with "only" or "default".

Thanks! What’s the difference between only and default, since we’re here? :)

"default" is only taken into account when the entry does not exist.

"only" sets the attribute to a single value during creation and update. Incredible useful when the entry is buggy, e.g. you have a copy 'n paste issue.