28 Feb
2016
28 Feb
'16
10:42 a.m.
On Fri, Feb 26, 2016 at 02:03:37PM +0100, Lukáš Hellebrandt wrote:
First question I have is that the URLs only match on complete string match. From past conversations I thought we wanted to add a more granular evaluation..?
I am planning to interpret URI as a prefix. However, there might be problem getting enough granularity because FreeIPA has dropped DENY rules: it will be hard to get some behaviors, e.g. "Allow access to hostname/* but not to hostname/admin/*". I do not know yet how to solve this.
Wouldn't it help if all rules that match URI-wise need to allow the person requesting the resource?