kanidmd_lib/migration_data/dl10/
groups.rs

Help
1use crate::entry::EntryInitNew;
2use crate::prelude::*;
3use crate::value::CredentialType;
4
5use kanidm_proto::internal::{Filter, OperationError, UiHint};
6
7#[derive(Clone, Debug, Default)]
8/// Built-in group definitions
9pub struct BuiltinGroup {
10    pub name: &'static str,
11    pub description: &'static str,
12    pub uuid: uuid::Uuid,
13    pub members: Vec<uuid::Uuid>,
14    pub entry_managed_by: Option<uuid::Uuid>,
15    pub dyngroup: bool,
16    pub dyngroup_filter: Option<Filter>,
17    pub extra_attributes: Vec<(Attribute, Value)>,
18}
19
20impl TryFrom<BuiltinGroup> for EntryInitNew {
21    type Error = OperationError;
22
23    fn try_from(val: BuiltinGroup) -> Result<Self, OperationError> {
24        let mut entry = EntryInitNew::new();
25
26        if val.uuid >= DYNAMIC_RANGE_MINIMUM_UUID {
27            error!("Builtin ACP has invalid UUID! {:?}", val);
28            return Err(OperationError::InvalidUuid);
29        }
30
31        entry.add_ava(Attribute::Name, Value::new_iname(val.name));
32        entry.add_ava(Attribute::Description, Value::new_utf8s(val.description));
33        // classes for groups
34        entry.set_ava(
35            Attribute::Class,
36            vec![EntryClass::Group.into(), EntryClass::Object.into()],
37        );
38        if val.dyngroup {
39            if !val.members.is_empty() {
40                return Err(OperationError::InvalidSchemaState(format!(
41                    "Builtin dyngroup {} has members specified, this is not allowed",
42                    val.name
43                )));
44            }
45            entry.add_ava(Attribute::Class, EntryClass::DynGroup.to_value());
46            match val.dyngroup_filter {
47                Some(filter) => entry.add_ava(Attribute::DynGroupFilter, Value::JsonFilt(filter)),
48                None => {
49                    error!(
50                        "No filter specified for dyngroup '{}' this is going to break things!",
51                        val.name
52                    );
53                    return Err(OperationError::FilterGeneration);
54                }
55            };
56        }
57
58        if let Some(entry_manager) = val.entry_managed_by {
59            entry.add_ava(Attribute::EntryManagedBy, Value::Refer(entry_manager));
60        }
61
62        entry.add_ava(Attribute::Uuid, Value::Uuid(val.uuid));
63        entry.set_ava(
64            Attribute::Member,
65            val.members
66                .into_iter()
67                .map(Value::Refer)
68                .collect::<Vec<Value>>(),
69        );
70        // add any extra attributes
71        val.extra_attributes
72            .into_iter()
73            .for_each(|(attr, val)| entry.add_ava(attr, val));
74        // all done!
75        Ok(entry)
76    }
77}
78
79lazy_static! {
80    // There are our built in "roles". They encapsulate some higher level collections
81    // of roles. The intent is to allow a pretty generic and correct by default set
82    // of these use cases.
83    pub static ref BUILTIN_GROUP_SYSTEM_ADMINS_V1: BuiltinGroup = BuiltinGroup {
84        name: NAME_SYSTEM_ADMINS,
85        description: "Builtin System Administrators Group.",
86        uuid: UUID_SYSTEM_ADMINS,
87        entry_managed_by: Some(UUID_SYSTEM_ADMINS),
88        members: vec![UUID_ADMIN],
89        ..Default::default()
90    };
91
92    pub static ref BUILTIN_GROUP_IDM_ADMINS_V1: BuiltinGroup = BuiltinGroup {
93        name: NAME_IDM_ADMINS,
94        description: "Builtin IDM Administrators Group.",
95        uuid: UUID_IDM_ADMINS,
96        entry_managed_by: Some(UUID_IDM_ADMINS),
97        members: vec![UUID_IDM_ADMIN],
98        ..Default::default()
99    };
100
101    pub static ref BUILTIN_GROUP_SERVICE_DESK: BuiltinGroup = BuiltinGroup {
102        name: "idm_service_desk",
103        description: "Builtin Service Desk Group.",
104        uuid: UUID_IDM_SERVICE_DESK,
105        entry_managed_by: Some(UUID_IDM_ADMINS),
106        members: vec![],
107        ..Default::default()
108    };
109}
110
111lazy_static! {
112    // These are the "finer" roles. They encapsulate different concepts in the system.
113    // The next section is the "system style" roles. These adjust the operation of
114    // kanidm and relate to it's internals and how it functions.
115    pub static ref BUILTIN_GROUP_RECYCLE_BIN_ADMINS: BuiltinGroup = BuiltinGroup {
116        name: "idm_recycle_bin_admins",
117        description: "Builtin Recycle Bin Administrators Group.",
118        uuid: UUID_IDM_RECYCLE_BIN_ADMINS,
119        entry_managed_by: Some(UUID_SYSTEM_ADMINS),
120        members: vec![UUID_SYSTEM_ADMINS],
121        ..Default::default()
122    };
123
124    /// Builtin IDM Group for granting local domain administration rights and trust administration rights
125    pub static ref BUILTIN_GROUP_DOMAIN_ADMINS: BuiltinGroup = BuiltinGroup {
126        name: "domain_admins",
127        description: "Builtin IDM Group for granting local domain administration rights and trust administration rights.",
128        uuid: UUID_DOMAIN_ADMINS,
129        entry_managed_by: Some(UUID_SYSTEM_ADMINS),
130        members: vec![UUID_SYSTEM_ADMINS],
131        ..Default::default()
132    };
133
134    pub static ref BUILTIN_GROUP_SCHEMA_ADMINS: BuiltinGroup = BuiltinGroup {
135        name: "idm_schema_admins",
136        description: "Builtin Schema Administration Group.",
137        uuid: UUID_IDM_SCHEMA_ADMINS,
138        entry_managed_by: Some(UUID_SYSTEM_ADMINS),
139        members: vec![UUID_SYSTEM_ADMINS],
140        ..Default::default()
141    };
142
143    pub static ref BUILTIN_GROUP_ACCESS_CONTROL_ADMINS: BuiltinGroup = BuiltinGroup {
144        name: "idm_access_control_admins",
145        description: "Builtin Access Control Administration Group.",
146        entry_managed_by: Some(UUID_SYSTEM_ADMINS),
147        uuid: UUID_IDM_ACCESS_CONTROL_ADMINS,
148        members: vec![UUID_SYSTEM_ADMINS],
149        ..Default::default()
150    };
151
152    // These are the IDM roles. They concern application integration, user permissions
153    // and credential security management.
154
155    /// Builtin IDM Group for managing persons and their account details
156    pub static ref BUILTIN_GROUP_PEOPLE_ADMINS: BuiltinGroup = BuiltinGroup {
157        name: "idm_people_admins",
158        description: "Builtin People Administration Group.",
159        uuid: UUID_IDM_PEOPLE_ADMINS,
160        entry_managed_by: Some(UUID_IDM_ADMINS),
161        members: vec![UUID_IDM_ADMINS],
162        ..Default::default()
163    };
164
165    pub static ref BUILTIN_GROUP_PEOPLE_ON_BOARDING: BuiltinGroup = BuiltinGroup {
166        name: "idm_people_on_boarding",
167        description: "Builtin People On Boarding Group.",
168        uuid: UUID_IDM_PEOPLE_ON_BOARDING,
169        entry_managed_by: Some(UUID_IDM_ADMINS),
170        members: vec![],
171        ..Default::default()
172    };
173
174    /// Builtin IDM Group for granting elevated people (personal data) read permissions.
175    pub static ref BUILTIN_GROUP_PEOPLE_PII_READ: BuiltinGroup = BuiltinGroup {
176        name: NAME_IDM_PEOPLE_PII_READ,
177        description: "Builtin IDM Group for granting elevated people (personal data) read permissions.",
178        uuid: UUID_IDM_PEOPLE_PII_READ,
179        entry_managed_by: Some(UUID_IDM_ADMINS),
180        members: vec![],
181        ..Default::default()
182    };
183
184    /// Builtin IDM Group for granting people the ability to write to their own name attributes.
185    pub static ref BUILTIN_GROUP_PEOPLE_SELF_NAME_WRITE_DL7: BuiltinGroup = BuiltinGroup {
186        name: "idm_people_self_name_write",
187        description: "Builtin IDM Group denoting users that can write to their own name attributes.",
188        uuid: UUID_IDM_PEOPLE_SELF_NAME_WRITE,
189        entry_managed_by: Some(UUID_IDM_ADMINS),
190        members: vec![
191            UUID_IDM_ALL_PERSONS
192        ],
193        ..Default::default()
194    };
195
196    pub static ref BUILTIN_GROUP_SERVICE_ACCOUNT_ADMINS: BuiltinGroup = BuiltinGroup {
197        name: "idm_service_account_admins",
198        description: "Builtin Service Account Administration Group.",
199        uuid: UUID_IDM_SERVICE_ACCOUNT_ADMINS,
200        entry_managed_by: Some(UUID_IDM_ADMINS),
201        members: vec![UUID_IDM_ADMINS],
202        ..Default::default()
203    };
204
205    /// Builtin IDM Group for managing oauth2 resource server integrations to this authentication domain.
206    pub static ref BUILTIN_GROUP_OAUTH2_ADMINS: BuiltinGroup = BuiltinGroup {
207        name: "idm_oauth2_admins",
208        description: "Builtin Oauth2 Integration Administration Group.",
209        uuid: UUID_IDM_OAUTH2_ADMINS,
210        entry_managed_by: Some(UUID_IDM_ADMINS),
211        members: vec![UUID_IDM_ADMINS],
212        ..Default::default()
213    };
214
215    pub static ref BUILTIN_GROUP_RADIUS_SERVICE_ADMINS: BuiltinGroup = BuiltinGroup {
216        name: "idm_radius_service_admins",
217        description: "Builtin Radius Administration Group.",
218        uuid: UUID_IDM_RADIUS_ADMINS,
219        entry_managed_by: Some(UUID_IDM_ADMINS),
220        members: vec![UUID_IDM_ADMINS],
221        ..Default::default()
222    };
223
224    /// Builtin IDM Group for RADIUS server access delegation.
225    pub static ref BUILTIN_IDM_RADIUS_SERVERS_V1: BuiltinGroup = BuiltinGroup {
226        name: "idm_radius_servers",
227        description: "Builtin IDM Group for RADIUS server access delegation.",
228        uuid: UUID_IDM_RADIUS_SERVERS,
229        entry_managed_by: Some(UUID_IDM_RADIUS_ADMINS),
230        members: vec![
231        ],
232        ..Default::default()
233    };
234
235    pub static ref BUILTIN_GROUP_MAIL_SERVICE_ADMINS_DL8: BuiltinGroup = BuiltinGroup {
236        name: "idm_mail_service_admins",
237        description: "Builtin Mail Server Administration Group.",
238        uuid: UUID_IDM_MAIL_ADMINS,
239        entry_managed_by: Some(UUID_IDM_ADMINS),
240        members: vec![UUID_IDM_ADMINS],
241        ..Default::default()
242    };
243
244    /// Builtin IDM Group for MAIL server Access delegation.
245    pub static ref BUILTIN_IDM_MAIL_SERVERS_DL8: BuiltinGroup = BuiltinGroup {
246        name: "idm_mail_servers",
247        description: "Builtin IDM Group for MAIL server access delegation.",
248        uuid: UUID_IDM_MAIL_SERVERS,
249        entry_managed_by: Some(UUID_IDM_MAIL_ADMINS),
250        members: vec![
251        ],
252        ..Default::default()
253    };
254
255    pub static ref BUILTIN_GROUP_ACCOUNT_POLICY_ADMINS: BuiltinGroup = BuiltinGroup {
256        name: "idm_account_policy_admins",
257        description: "Builtin Account Policy Administration Group.",
258        uuid: UUID_IDM_ACCOUNT_POLICY_ADMINS,
259        entry_managed_by: Some(UUID_IDM_ADMINS),
260        members: vec![UUID_IDM_ADMINS],
261        ..Default::default()
262    };
263
264    /// Builtin IDM Group for managing posix/unix attributes on groups and users.
265    pub static ref BUILTIN_GROUP_UNIX_ADMINS: BuiltinGroup = BuiltinGroup {
266        name: "idm_unix_admins",
267        description: "Builtin Unix Administration Group.",
268        uuid: UUID_IDM_UNIX_ADMINS,
269        entry_managed_by: Some(UUID_IDM_ADMINS),
270        members: vec![UUID_IDM_ADMINS],
271        ..Default::default()
272    };
273
274    /// Builtin IDM Group for managing client authentication certificates.
275    pub static ref BUILTIN_GROUP_CLIENT_CERTIFICATE_ADMINS_DL7: BuiltinGroup = BuiltinGroup {
276        name: "idm_client_certificate_admins",
277        description: "Builtin Client Certificate Administration Group.",
278        uuid: UUID_IDM_CLIENT_CERTIFICATE_ADMINS,
279        entry_managed_by: Some(UUID_IDM_ADMINS),
280        members: vec![UUID_IDM_ADMINS],
281        ..Default::default()
282    };
283
284    /// Builtin IDM Group for granting elevated group write and lifecycle permissions.
285    pub static ref IDM_GROUP_ADMINS_V1: BuiltinGroup = BuiltinGroup {
286        name: "idm_group_admins",
287        description: "Builtin IDM Group for granting elevated group write and lifecycle permissions.",
288        uuid: UUID_IDM_GROUP_ADMINS,
289        entry_managed_by: Some(UUID_IDM_ADMINS),
290        members: vec![UUID_IDM_ADMINS],
291        ..Default::default()
292    };
293
294    /// Self-write of mail
295    pub static ref IDM_PEOPLE_SELF_MAIL_WRITE_DL7: BuiltinGroup = BuiltinGroup {
296        name: "idm_people_self_mail_write",
297        description: "Builtin IDM Group for people accounts to update their own mail.",
298        uuid: UUID_IDM_PEOPLE_SELF_MAIL_WRITE,
299        members: Vec::with_capacity(0),
300        ..Default::default()
301    };
302}
303
304// at some point vs code just gives up on syntax highlighting inside lazy_static...
305lazy_static! {
306    pub static ref IDM_ALL_PERSONS: BuiltinGroup = BuiltinGroup {
307        name: "idm_all_persons",
308        description: "Builtin IDM dynamic group containing all persons.",
309        uuid: UUID_IDM_ALL_PERSONS,
310        members: Vec::with_capacity(0),
311        dyngroup: true,
312        dyngroup_filter: Some(
313            Filter::And(vec![
314                Filter::Eq(Attribute::Class.to_string(), EntryClass::Person.to_string()),
315                Filter::Eq(Attribute::Class.to_string(), EntryClass::Account.to_string()),
316            ])
317        ),
318        extra_attributes: vec![
319            // Enable account policy by default
320            (Attribute::Class, EntryClass::AccountPolicy.to_value()),
321            // Enforce this is a system protected object
322            (Attribute::Class, EntryClass::System.to_value()),
323            // MFA By Default
324            (Attribute::CredentialTypeMinimum, CredentialType::Mfa.into()),
325        ],
326        ..Default::default()
327    };
328
329    pub static ref IDM_ALL_ACCOUNTS: BuiltinGroup = BuiltinGroup {
330        name: NAME_IDM_ALL_ACCOUNTS,
331        description: "Builtin IDM dynamic group containing all entries that can authenticate.",
332        uuid: UUID_IDM_ALL_ACCOUNTS,
333        members: Vec::with_capacity(0),
334        dyngroup: true,
335        dyngroup_filter: Some(
336                Filter::Eq(Attribute::Class.to_string(), EntryClass::Account.to_string()),
337        ),
338        extra_attributes: vec![
339            // Enable account policy by default
340            (Attribute::Class, EntryClass::AccountPolicy.to_value()),
341            // Enforce this is a system protected object
342            (Attribute::Class, EntryClass::System.to_value()),
343        ],
344        ..Default::default()
345    };
346
347
348    pub static ref IDM_UI_ENABLE_EXPERIMENTAL_FEATURES: BuiltinGroup = BuiltinGroup {
349        name: "idm_ui_enable_experimental_features",
350        description: "Members of this group will have access to experimental web UI features.",
351        uuid: UUID_IDM_UI_ENABLE_EXPERIMENTAL_FEATURES,
352        entry_managed_by: Some(UUID_IDM_ADMINS),
353        extra_attributes: vec![
354            (Attribute::GrantUiHint, Value::UiHint(UiHint::ExperimentalFeatures))
355        ],
356        ..Default::default()
357    };
358
359    /// Members of this group will have access to read the mail attribute of all persons and service accounts.
360    pub static ref IDM_ACCOUNT_MAIL_READ: BuiltinGroup = BuiltinGroup {
361        name: "idm_account_mail_read",
362        description: "Members of this group will have access to read the mail attribute of all persons and service accounts.",
363        entry_managed_by: Some(UUID_IDM_ACCESS_CONTROL_ADMINS),
364        uuid: UUID_IDM_ACCOUNT_MAIL_READ,
365        ..Default::default()
366    };
367
368    /// This must be the last group to init to include the UUID of the other high priv groups.
369    pub static ref IDM_HIGH_PRIVILEGE_DL8: BuiltinGroup = BuiltinGroup {
370        name: "idm_high_privilege",
371        uuid: UUID_IDM_HIGH_PRIVILEGE,
372        entry_managed_by: Some(UUID_IDM_ACCESS_CONTROL_ADMINS),
373        description: "Builtin IDM provided groups with high levels of access that should be audited and limited in modification.",
374        members: vec![
375            UUID_SYSTEM_ADMINS,
376            UUID_IDM_ADMINS,
377            UUID_DOMAIN_ADMINS,
378            UUID_IDM_SERVICE_DESK,
379            UUID_IDM_RECYCLE_BIN_ADMINS,
380            UUID_IDM_SCHEMA_ADMINS,
381            UUID_IDM_ACCESS_CONTROL_ADMINS,
382            UUID_IDM_OAUTH2_ADMINS,
383            UUID_IDM_RADIUS_ADMINS,
384            UUID_IDM_ACCOUNT_POLICY_ADMINS,
385            UUID_IDM_RADIUS_SERVERS,
386            UUID_IDM_GROUP_ADMINS,
387            UUID_IDM_UNIX_ADMINS,
388            UUID_IDM_PEOPLE_PII_READ,
389            UUID_IDM_PEOPLE_ADMINS,
390            UUID_IDM_PEOPLE_ON_BOARDING,
391            UUID_IDM_SERVICE_ACCOUNT_ADMINS,
392            UUID_IDM_CLIENT_CERTIFICATE_ADMINS,
393            UUID_IDM_APPLICATION_ADMINS,
394            UUID_IDM_MAIL_ADMINS,
395            UUID_IDM_HIGH_PRIVILEGE,
396        ],
397        ..Default::default()
398    };
399
400    pub static ref BUILTIN_GROUP_APPLICATION_ADMINS_DL8: BuiltinGroup = BuiltinGroup {
401        name: "idm_application_admins",
402        uuid: UUID_IDM_APPLICATION_ADMINS,
403        description: "Builtin Application Administration Group.",
404        entry_managed_by: Some(UUID_IDM_ADMINS),
405        members: vec![UUID_IDM_ADMINS],
406        ..Default::default()
407    };
408}
kanidmd_lib/migration_data/dl10/groups.rs

kanidmd_lib/migration_data/dl10/
groups.rs
