On Fri, Feb 26, 2016 at 02:03:37PM +0100, Lukáš Hellebrandt wrote:
> First question I have is that the URLs only match on complete
string
> match. From past conversations I thought we wanted to add a more
> granular evaluation..?
I am planning to interpret URI as a prefix. However, there might be
problem getting enough granularity because FreeIPA has dropped DENY
rules: it will be hard to get some behaviors, e.g. "Allow access to
hostname/* but not to hostname/admin/*". I do not know yet how to solve
this.
One possibility is to treat the prefix hostname/ as separate "object"
to hostname/admin/. So whatever allow rules you put in for hostname/
will not be inherited / will not affect hostname/admin/.
--
Jan Pazdziora
Senior Principal Software Engineer, Identity Management Engineering, Red Hat