[ ispman-Patches-1692612 ] PAB per domain and per user support

Patches item #1692612, was opened at 2007-04-02 02:23
Message generated for change (Comment added) made by jdelker
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=308390&aid=1692612&group_id=8390

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
>Status: Closed
>Resolution: Accepted
Priority: 5
Private: No
Submitted By: Pedro Algarvio (s0undt3ch)
>Assigned to: Joerg Delker (jdelker)
Summary: PAB per domain and per user support

Initial Comment:
I'll attach my modifications to the ispman CVS of current HEAD.

If these changes are good, I'll check-in my local modifications to CVS, just say so.

----------------------------------------------------------------------

>Comment By: Joerg Delker (jdelker)
Date: 2007-04-19 00:32

Message:
Logged In: YES 
user_id=43997
Originator: NO

patch was applied to main trunk.

----------------------------------------------------------------------

Comment By: Pedro Algarvio (s0undt3ch)
Date: 2007-04-14 14:20

Message:
Logged In: YES 
user_id=927681
Originator: YES

Regarding an enhancement proposed by derjohn, make it an admin choice, the
ability for a user to read and/or write to the domain's global address
book.
This *can* be achieved by creating 2 auxiliary groupOfNames, initial ldif
follows:
---------8<---------8<---------8<---------8<---------8<---------8<---------
dn: cn=gabRead,ou=domain.tld,ou=pabs,o=ispman
objectClass: groupOfNames
objectClass: top
cn: gabRead
member: uid=userid_domain_tld,ou=users,ispmanDomain=domain.tld,o=ispman

dn: cn=gabWrite,ou=domain.tld,ou=pabs,o=ispman
objectClass: groupOfNames
objectClass: top
cn: gabWrite
member:
---------8<---------8<---------8<---------8<---------8<---------8<---------

LDAP does not complain if we repeat the cn's gabWrite/gabRead for the
several domains we host.

The needed ACL is:
---------8<---------8<---------8<---------8<---------8<---------8<---------8<---------
access to dn.regex="^(.+,)?ou=([^,]+),ou=pabs,o=ispman$"
        filter=(objectclass=inetOrgPerson)
        by dn.exact,expand="ispmanDomain=$2,o=ispman" write
        by set.regex="[cn=gabRead,ou=$2,ou=pabs,o=ispman]/member & user"
read
        by set.regex="[cn=gabWrite,ou=$2,ou=pabs,o=ispman]/member & user"
write
        by * none
---------8<---------8<---------8<---------8<---------8<---------8<---------8<---------
First rule, write access to the domain ownwer binding as the domain DN
Seccond rule, allow users belonging to the gabRead groupOfNames of his
specific domain to read the gab
Third rule, allow users belonging to the gabWrite groupOfNames of his
specific domain to read the gab
Forth rule, deny anyone else.

A patch to this behaviour still needs to be created, I only tested the
needed stuff to do it, and the necessary tweaks on the Admin UI regarding
the "edit user template" so we can grant those gab permissions to the
user.

If anyone has a better way, please tell ;)

----------------------------------------------------------------------

Comment By: Pedro Algarvio (s0undt3ch)
Date: 2007-04-13 21:07

Message:
Logged In: YES 
user_id=927681
Originator: YES

File Added: ispman-abs-support.diff

----------------------------------------------------------------------

Comment By: Pedro Algarvio (s0undt3ch)
Date: 2007-04-02 03:17

Message:
Logged In: YES 
user_id=927681
Originator: YES

The patch was tested and is apparently working perfectly.

----------------------------------------------------------------------

Comment By: Pedro Algarvio (s0undt3ch)
Date: 2007-04-02 03:13

Message:
Logged In: YES 
user_id=927681
Originator: YES

File Added: pab_support.diff

----------------------------------------------------------------------

Comment By: Pedro Algarvio (s0undt3ch)
Date: 2007-04-02 02:29

Message:
Logged In: YES 
user_id=927681
Originator: YES

One thing is still missing, pab deletes upon user/domain deletion.

----------------------------------------------------------------------

Comment By: Pedro Algarvio (s0undt3ch)
Date: 2007-04-02 02:25

Message:
Logged In: YES 
user_id=927681
Originator: YES

File Added: pab_support.diff

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=308390&aid=1692612&group_id=8390

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/