Ease ACL handling

Using ACL in FD is a hell right now, nothing is logical.

I propose we do a reorganization of the IHM to clarify all this :

• We remove the possibility of assigning ACL in a other way than through a role
• We separate ACL roles definitions from Role assignation
• User and groups have a roles tab to easily assign them roles
• We remove the ACL tab which is on all objects
• We have a few roles predefined on FD installation

(from redmine: issue id 2670, created on 2013-08-23, closed on 2014-04-23)

• Relations:
  • relates #3065
  • copied_to #2884
• Changesets:
  • Revision 7c139b9f by Côme Chilliet on 2013-08-29T14:45:48.000Z:

Fixes: #2670 aclRole using simplePlugin

• Revision 29961672 by Côme Chilliet on 2013-09-21T09:57:25.000Z:

Fixes: #2670 aclRole using simplePlugin

• Revision fc90232a by Côme Chilliet on 2013-11-21T18:28:21.000Z:

Fixes: #2670 Simplifying ACL roles

• Revision fa1c5bf7 by Côme Chilliet on 2013-11-21T18:28:33.000Z:

Fixes: #2670 Simplifying ACL roles

• Revision 330b85d7 by Côme Chilliet on 2013-11-27T19:35:51.000Z:

Fixes: #2670 ACL refactoring

ACL are now always based on roles.
Old ACLs will needs to be migrated.

• Revision f9560d4c by Benoit MORTIER on 2013-11-28T14:49:38.000Z:

Fixes: #2670 ACL refactoring

• Revision 59b1c428 by Côme Chilliet on 2013-11-28T17:36:49.000Z:

Fixes: #2670 fixed aclAssignment account handling

• Revision 3019837c by Côme Chilliet on 2013-11-28T17:37:21.000Z:

Fixes: #2670 fixed aclAssignment account handling

• Revision 54b1aefd by Côme Chilliet on 2013-12-02T17:58:26.000Z:

Fixes: #2670 Removed useless part from class_acl

• Revision e8fedde7 by Côme Chilliet on 2013-12-02T17:58:43.000Z:

Fixes: #2670 Removed useless part from class_acl

• Revision 85247b2a by Côme Chilliet on 2013-12-02T17:59:02.000Z:

Fixes: #2670 changed acl call in user

• Revision 003b6905 by Côme Chilliet on 2013-12-03T18:20:01.000Z:

Fixes: #2670 Fixed a typo in class_acl

• Revision 53e4ddb2 by Côme Chilliet on 2013-12-03T18:20:17.000Z:

Fixes: #2670 Fixed a typo in class_acl

• Revision 50fa504f by Côme Chilliet on 2013-12-04T18:14:03.000Z:

Fixes: #2670 Adapted fusiondirectory-setup to new ACL system

• Revision d8264038 by Côme Chilliet on 2013-12-04T18:14:20.000Z:

Fixes: #2670 Fixed setup so that it works with new ACL format

• Revision edf4cd89 by Côme Chilliet on 2013-12-04T18:14:38.000Z:

Fixes: #2670 Adapted fusiondirectory-setup to new ACL system

• Revision a21149c8 by Côme Chilliet on 2013-12-04T18:14:48.000Z:

Fixes: #2670 Fixed setup so that it works with new ACL format

• Revision 8b475224 by Côme Chilliet on 2013-12-05T18:18:02.000Z:

Fixes: #2670 Added a migrate-acls command to fusiondirectory-setup

• Revision ba52f51e by Côme Chilliet on 2013-12-05T18:18:26.000Z:

Fixes: #2670 Added a migrate-acls command to fusiondirectory-setup

• Revision 1d0901c5 by Côme Chilliet on 2013-12-09T17:35:46.000Z:

Fixes: #2670 Fixed acl scope default value (base for nodes, subtree for containers)

• Revision a8d31a3b by Côme Chilliet on 2013-12-09T17:36:02.000Z:

Fixes: #2670 Fixed acl scope default value (base for nodes, subtree for containers)

• Revision 98a6b9c3 by Côme Chilliet on 2013-12-17T18:05:10.000Z:

Fixes: #2670 Using simpleManagement for ACLs

• Revision 1a2f57c9 by Côme Chilliet on 2013-12-17T18:05:24.000Z:

Fixes: #2670 Using simpleManagement for ACLs

• Revision ed9b1b61 by Côme Chilliet on 2013-12-18T15:53:29.000Z:

Fixes: #2670 fixed aclManagement problems

• Revision 85622219 by Côme Chilliet on 2013-12-18T15:53:52.000Z:

Fixes: #2670 fixed aclManagement problems

• Custom Fields:
  • Bug in version: 1.0.6
• Uploads:
  • 0001-Fixes-2670-aclRole-using-simplePlugin.patch
  • 0002-Fixes-2670-Simplifying-ACL-roles.patch
  • 0003-Fixes-2670-ACL-refactoring.patch
  • 0004-Fixes-2670-fixed-aclAssignment-account-handling.patch
  • 0005-Fixes-2670-Removed-useless-part-from-class_acl.patch
  • 0006-Fixes-2670-changed-acl-call-in-user.patch
  • 0001-Fixes-2670-Fixed-a-typo-in-class_acl.patch
  • 0007-Fixes-2670-Adapted-fusiondirectory-setup-to-new-ACL-.patch
  • 0008-Fixes-2670-Fixed-setup-so-that-it-works-with-new-ACL.patch
  • 0009-Fixes-2670-Added-a-migrate-acls-command-to-fusiondir.patch
  • 00010-Fixed-ACL-iconMini.patch
  • 00011-Fixes-2670-Fixed-acl-scope-default-value-base-for-no.patch
  • 00012-Fixes-2670-Using-simpleManagement-for-ACLs.patch
  • 00013-Fixes-2670-fixed-aclManagement-problems.patch

I'm ok with all the propositions. Clarification is always a good thing.

I think this must be done earlier than 1.1 well in fact lot of important things are waiting... so.

A question in french and translated after : Es-ce qu'il sera possible de définir une ACL permettant à un utilisateur d'éditer les attributs d'uun groupe donné ?

Will it be possible te create ACL which allow an user to write attributs of a given groupe ?

(from redmine: written on 2013-08-24)

By amichon on 2017-09-02T15:03:49 (imported from GitLab)

Alexis MICHON wrote:

Will it be possible te create ACL which allow an user to write attributs of a given groupe ?

This ticket is mainly about changing the way ACLs are displayed and edited, but it does not change the way they work. Adding a type of ACL working on groups or more likely ogroups should be in a separated ticket if it's something we want.

(from redmine: written on 2013-08-26)

By Côme Chilliet on 2017-09-02T15:03:49 (imported from GitLab)

Hello,

i agree on the ihm simplification, it should be done for next stable version 1.0.8. it would be a bonus also to come with several roles predefined into the application to help user start using acl

Cheers

(from redmine: written on 2013-08-26)

By bmortier on 2017-09-02T15:03:49 (imported from GitLab)

This is far from being complete but aclRole is now based on simplePlugin, this should ease future developments. Needs last simplePlugin commit

(from redmine: written on 2013-08-29)

By Côme Chilliet on 2017-09-02T15:03:49 (imported from GitLab)

Hello,

applied to 1.1 for now

Cheers

(from redmine: written on 2013-08-29)

By bmortier on 2017-09-02T15:03:49 (imported from GitLab)

So, the ACLs should work this way: Defining a role means defining which rights we give, and on which type of objects. Applying a role means choosing a set of users, a role to apply for them, and LDAP nodes for which they have this role. The last part is done by selecting a node and a scope.

(from redmine: written on 2013-11-21)

By Côme Chilliet on 2017-09-02T15:03:49 (imported from GitLab)

Hello,

applied to 1.0.8 and 1.1

Cheers

(from redmine: written on 2013-11-21)

By bmortier on 2017-09-02T15:03:50 (imported from GitLab)

I can't do something using the same LDAP schema, so we might as well redo the LDAP schema properly. I'd suggest this :

• fdAclRole is an acl role, containing acl the same way as before : @users;rw#groups;r@
• fdAclAssignment is an acl assignment, looking like @base:scope:role:members@ ** base is the dn of a node ** scope is either 'base' or 'subtree' ** role is the dn of a role ** members are members, same syntax as before, dns of groups or users separated by ',' ** All dns are base64 encoded

So all acl assignments would be attributes on the LDAP base node instead of being attributes on their base node as before.

(from redmine: written on 2013-11-25)

By Côme Chilliet on 2017-09-02T15:03:50 (imported from GitLab)

Do not commit this, it's unfinished and bugged, it's just to be sure of not losing it. (it's for 1.1, it might need some adjustments for 1.0.8)

(from redmine: written on 2013-11-26)

By Côme Chilliet on 2017-09-02T15:03:50 (imported from GitLab)

This is starting to work. Manual ACL migration is needed for now.

We still need to adapt some things (installation and fd-setup admin creation code for instance). We also need to add the creation of some default roles during installation.

(from redmine: written on 2013-11-27)

By Côme Chilliet on 2017-09-02T15:03:50 (imported from GitLab)

Please commit last patch on 1.1. Try to apply it to 1.0.8 but you should encounter conflitcs, please post them here.

(from redmine: written on 2013-11-27)

By Côme Chilliet on 2017-09-02T15:03:50 (imported from GitLab)

Hello,

applied to 1.1

For 1.0.8

CONFLICT (content): Merge conflict in plugins/admin/groups/group-list.xml

<<<<<<< HEAD sub images/lists/new.png Create

  <name>create</name>
  <type>sub</type>
  <image>images/lists/new.png</image>
  <label>Create</label>
  <acl>[c]</acl>

Fixes: #2670 ACL refactoring

<action>
  <name>edit</name>
  <type>entry</type>
  <image>images/lists/edit.png</image>
  <label>Edit</label>

<<<<<<< HEAD

  <acl>[r]</acl>

Fixes: #2670 ACL refactoring

(from redmine: written on 2013-11-27)

By bmortier on 2017-09-02T15:03:51 (imported from GitLab)

Hum take the patch version. Is this the only conflict? I was expecting one in plugin :-)

(from redmine: written on 2013-11-28)

By Côme Chilliet on 2017-09-02T15:03:51 (imported from GitLab)

applied to 1.0.8

cheers

(from redmine: written on 2013-11-28)

By bmortier on 2017-09-02T15:03:51 (imported from GitLab)

This patch is for both 1.0.8 and 1.1

(from redmine: written on 2013-12-02)

By Côme Chilliet on 2017-09-02T15:03:51 (imported from GitLab)

Patch for 1.1 only

(from redmine: written on 2013-12-02)

By Côme Chilliet on 2017-09-02T15:03:51 (imported from GitLab)

For 1.1 and 1.0.8

(from redmine: written on 2013-12-03)

By Côme Chilliet on 2017-09-02T15:03:52 (imported from GitLab)

hello,

commited 1.0.8 and 1.1

Cheers

(from redmine: written on 2013-12-03)

By bmortier on 2017-09-02T15:03:52 (imported from GitLab)

For 1.1 and 1.0.8, fusiondirectory-setup --check-ldap is working again.

(from redmine: written on 2013-12-04)

By Côme Chilliet on 2017-09-02T15:03:52 (imported from GitLab)

last patch is also for both 1.1 and 1.0.8

(from redmine: written on 2013-12-04)

By Côme Chilliet on 2017-09-02T15:03:52 (imported from GitLab)