Commit Graph

11 Commits

Author SHA1 Message Date
Fabian Grünbichler
21f523a5c1 user.cfg: skip inexisting roles when parsing ACLs
we do the same for missing users, groups and tokens, and just like
groups, roles with an empty privilege set are explicitly allowed so
pre-generating placeholders is possible.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2020-01-29 21:21:59 +01:00
Fabian Grünbichler
9449fe2138 tests: unify config file naming
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2020-01-29 21:21:58 +01:00
Fabian Grünbichler
891f7afa92 test: add token-related tests
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2020-01-29 21:21:58 +01:00
Fabian Grünbichler
7e8bcaa754 roles()/permissions(): also return propagate flag
this information is already available, but not exposed. we need it for
dumping an effective permission tree of a given user/token.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2020-01-29 21:21:58 +01:00
Fabian Grünbichler
7d1739ad60 test: add parser/writer tests
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2020-01-27 18:34:01 +01:00
Fabian Grünbichler
a31f1d85f9 rpcenv: drop unused roles()
it was useful for test-cases to verify the behaviour when pools where
introduced, but it is not used anywhere else in the code base and those
tests can also just check on permission-level.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2020-01-14 12:24:04 +01:00
Fabian Grünbichler
9efcb56129 access-control: remove check_permissions/permission
they have been handled by PVE::RPCEnvironment for quite some time
already, and the versions there are the complete ones that should be
actually used.

manager switched over their last use not long ago, in 6.0-9, so
record a Breaks to that version.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2019-11-23 18:12:50 +01:00
Dominik Csapak
b34d76e726 replace read_password with param_mapping
use the get_standar_mapping 'pve-password'
then we can get rid of the Term::ReadLine dependency

we use this change to only ask for the password once on
'pveum ticket'

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
2018-06-27 13:27:22 +02:00
Dietmar Maurer
8ade28e685 fix NoAccess when inheritred from pool 2012-01-26 06:13:59 +01:00
Dietmar Maurer
4bc17477d8 start pool support, return NoAccess role, fix acl cache 2012-01-25 14:32:12 +01:00
Dietmar Maurer
2c3a6c0aaa iimported from svn 'pve-access-control/trunk' 2011-08-23 07:27:48 +02:00