1#![allow(clippy::expect_used)]
2use crate::constants::uuids::*;
5use crate::entry::EntryInitNew;
6use crate::prelude::*;
7use crate::value::Value;
8use kanidm_proto::internal::Filter as ProtoFilter;
9
10lazy_static! {
11 pub static ref FILTER_RECYCLED_OR_TOMBSTONE: ProtoFilter = ProtoFilter::Or(vec![
13 match_class_filter!(EntryClass::Recycled),
14 match_class_filter!(EntryClass::Tombstone),
15 ]);
16
17 pub static ref FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED: ProtoFilter =
19 ProtoFilter::AndNot(Box::new(FILTER_RECYCLED_OR_TOMBSTONE.clone()));
20
21 pub static ref FILTER_HP: ProtoFilter = ProtoFilter::Eq(
23 Attribute::MemberOf.to_string(),
24 UUID_IDM_HIGH_PRIVILEGE.to_string(),
25 );
26
27 pub static ref FILTER_HP_OR_RECYCLED_OR_TOMBSTONE: ProtoFilter = ProtoFilter::Or(vec![
29 FILTER_HP.clone(),
30 match_class_filter!(EntryClass::Recycled),
31 match_class_filter!(EntryClass::Tombstone),
32 ]);
33
34 pub static ref FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE: ProtoFilter =
35 ProtoFilter::AndNot(Box::new(FILTER_HP_OR_RECYCLED_OR_TOMBSTONE.clone()));
36
37 pub static ref DEFAULT_TARGET_SCOPE: ProtoFilter = ProtoFilter::And(Vec::with_capacity(0));
38
39}
40
41#[derive(Clone, Debug, Default)]
42pub enum BuiltinAcpReceiver {
44 #[default]
45 None,
46 Group(Vec<Uuid>),
49 EntryManager,
50}
51
52#[derive(Clone, Debug, Default)]
53pub enum BuiltinAcpTarget {
55 #[default]
56 None,
57 Filter(ProtoFilter),
59 }
61
62#[derive(Clone, Debug, Default)]
63pub struct BuiltinAcp {
65 classes: Vec<EntryClass>,
66 pub name: &'static str,
67 uuid: Uuid,
68 description: &'static str,
69 receiver: BuiltinAcpReceiver,
70 target: BuiltinAcpTarget,
71 search_attrs: Vec<Attribute>,
72 modify_present_attrs: Vec<Attribute>,
73 modify_removed_attrs: Vec<Attribute>,
74 modify_classes: Vec<EntryClass>,
75 modify_present_classes: Vec<EntryClass>,
76 modify_remove_classes: Vec<EntryClass>,
77 create_classes: Vec<EntryClass>,
78 create_attrs: Vec<Attribute>,
79}
80
81impl From<BuiltinAcp> for EntryInitNew {
82 #[allow(clippy::panic)]
83 fn from(value: BuiltinAcp) -> Self {
84 let mut entry = EntryInitNew::default();
85
86 #[allow(clippy::panic)]
87 if value.name.is_empty() {
88 panic!("Builtin ACP has no name! {value:?}");
89 }
90 #[allow(clippy::panic)]
91 if value.classes.is_empty() {
92 panic!("Builtin ACP has no classes! {value:?}");
93 }
94
95 value.classes.iter().for_each(|class| {
96 entry.add_ava(Attribute::Class, class.to_value());
97 });
98
99 entry.set_ava(Attribute::Name, [Value::new_iname(value.name)]);
100
101 if value.uuid >= DYNAMIC_RANGE_MINIMUM_UUID {
102 panic!("Builtin ACP has invalid UUID! {value:?}");
103 }
104
105 entry.set_ava(Attribute::Uuid, [Value::Uuid(value.uuid)]);
106 entry.set_ava(
107 Attribute::Description,
108 [Value::new_utf8s(value.description)],
109 );
110
111 match &value.receiver {
112 #[allow(clippy::panic)]
113 BuiltinAcpReceiver::None => {
114 panic!("Builtin ACP has no receiver! {:?}", &value);
115 }
116 BuiltinAcpReceiver::Group(list) => {
117 entry.add_ava(
118 Attribute::Class,
119 EntryClass::AccessControlReceiverGroup.to_value(),
120 );
121 for group in list {
122 entry.set_ava(Attribute::AcpReceiverGroup, [Value::Refer(*group)]);
123 }
124 }
125 BuiltinAcpReceiver::EntryManager => {
126 entry.add_ava(
127 Attribute::Class,
128 EntryClass::AccessControlReceiverEntryManager.to_value(),
129 );
130 }
131 };
132
133 match &value.target {
134 #[allow(clippy::panic)]
135 BuiltinAcpTarget::None => {
136 panic!("Builtin ACP has no target! {:?}", &value);
137 }
138 BuiltinAcpTarget::Filter(proto_filter) => {
139 entry.add_ava(
140 Attribute::Class,
141 EntryClass::AccessControlTargetScope.to_value(),
142 );
143 entry.set_ava(
144 Attribute::AcpTargetScope,
145 [Value::JsonFilt(proto_filter.clone())],
146 );
147 }
148 }
149
150 entry.set_ava(
151 Attribute::AcpSearchAttr,
152 value
153 .search_attrs
154 .into_iter()
155 .map(Value::from)
156 .collect::<Vec<Value>>(),
157 );
158 value.modify_present_attrs.into_iter().for_each(|attr| {
159 entry.add_ava(Attribute::AcpModifyPresentAttr, Value::from(attr));
160 });
161 value.modify_removed_attrs.into_iter().for_each(|attr| {
162 entry.add_ava(Attribute::AcpModifyRemovedAttr, Value::from(attr));
163 });
164
165 value.modify_classes.into_iter().for_each(|class| {
166 entry.add_ava(Attribute::AcpModifyClass, Value::from(class));
167 });
168
169 value.modify_present_classes.into_iter().for_each(|class| {
170 entry.add_ava(Attribute::AcpModifyPresentClass, Value::from(class));
171 });
172
173 value.modify_remove_classes.into_iter().for_each(|class| {
174 entry.add_ava(Attribute::AcpModifyRemoveClass, Value::from(class));
175 });
176
177 value.create_classes.into_iter().for_each(|class| {
178 entry.add_ava(Attribute::AcpCreateClass, Value::from(class));
179 });
180 value.create_attrs.into_iter().for_each(|attr| {
181 entry.add_ava(Attribute::AcpCreateAttr, Value::from(attr));
182 });
183 entry
184 }
185}
186
187lazy_static! {
188 pub static ref IDM_ACP_RECYCLE_BIN_SEARCH_V1: BuiltinAcp = BuiltinAcp {
189 uuid: UUID_IDM_ACP_RECYCLE_BIN_SEARCH_V1,
190 name: "idm_acp_recycle_bin_search",
191 description: "Builtin IDM recycle bin search permission.",
192 classes: vec![
193 EntryClass::Object,
194 EntryClass::AccessControlProfile,
195 EntryClass::AccessControlSearch,
196 ],
197 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_RECYCLE_BIN_ADMINS]),
198 target: BuiltinAcpTarget::Filter(ProtoFilter::Eq(
199 Attribute::Class.to_string(),
200 ATTR_RECYCLED.to_string()
201 )),
202
203 search_attrs: vec![
204 Attribute::Class,
205 Attribute::Name,
206 Attribute::Uuid,
207 Attribute::LastModifiedCid,
208 ],
209 ..Default::default()
210 };
211}
212
213lazy_static! {
214 pub static ref IDM_ACP_RECYCLE_BIN_REVIVE_V1: BuiltinAcp = BuiltinAcp {
215 uuid: UUID_IDM_ACP_RECYCLE_BIN_REVIVE_V1,
216 name: "idm_acp_recycle_bin_revive",
217 description: "Builtin IDM recycle bin revive permission.",
218 classes: vec![
219 EntryClass::Object,
220 EntryClass::AccessControlProfile,
221 EntryClass::AccessControlModify,
222 ],
223 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_RECYCLE_BIN_ADMINS]),
224 target: BuiltinAcpTarget::Filter(ProtoFilter::Eq(
225 Attribute::Class.to_string(),
226 ATTR_RECYCLED.to_string()
227 )),
228 modify_removed_attrs: vec![Attribute::Class],
229 modify_remove_classes: vec![EntryClass::Recycled],
230 ..Default::default()
231 };
232}
233
234lazy_static! {
235 pub static ref IDM_ACP_SCHEMA_WRITE_ATTRS_V1: BuiltinAcp = BuiltinAcp{
236 classes: vec![
237 EntryClass::Object,
238 EntryClass::AccessControlProfile,
239 EntryClass::AccessControlCreate,
240 EntryClass::AccessControlModify,
241 EntryClass::AccessControlSearch
242 ],
243 name: "idm_acp_schema_write_attrs",
244 uuid: UUID_IDM_ACP_SCHEMA_WRITE_ATTRS_V1,
245 description: "Builtin IDM Control for management of schema attributes.",
246 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_SCHEMA_ADMINS] ),
247 target: BuiltinAcpTarget::Filter( ProtoFilter::And(vec![
249 ProtoFilter::Eq(EntryClass::Class.to_string(),EntryClass::AttributeType.to_string()),
250 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
251 ])),
252 search_attrs: vec![
253 Attribute::Class,
254 Attribute::Description,
255 Attribute::Index,
256 Attribute::Unique,
257 Attribute::MultiValue,
258 Attribute::AttributeName,
259 Attribute::Syntax,
260 Attribute::Uuid,
261 ],
262 modify_removed_attrs: vec![
263 Attribute::Description,
264 Attribute::Index,
265 Attribute::Unique,
266 Attribute::MultiValue,
267 Attribute::Syntax,
268 ],
269 modify_present_attrs: vec![
270 Attribute::Description,
271 Attribute::Index,
272 Attribute::Unique,
273 Attribute::MultiValue,
274 Attribute::Syntax,
275 ],
276 create_attrs: vec![
277 Attribute::Class,
278 Attribute::Description,
279 Attribute::Index,
280 Attribute::Unique,
281 Attribute::MultiValue,
282 Attribute::AttributeName,
283 Attribute::Syntax,
284 Attribute::Uuid,
285 ],
286 create_classes: vec![
287 EntryClass::Object,
288 EntryClass::AttributeType,
289 ],
290 ..Default::default()
291 };
292}
293
294lazy_static! {
295 pub static ref IDM_ACP_SCHEMA_WRITE_CLASSES_V1: BuiltinAcp = BuiltinAcp {
296 classes: vec![
297 EntryClass::Object,
298 EntryClass::AccessControlProfile,
299 EntryClass::AccessControlCreate,
300 EntryClass::AccessControlModify,
301 EntryClass::AccessControlSearch
302 ],
303 name: "idm_acp_schema_write_classes",
304 uuid: UUID_IDM_ACP_SCHEMA_WRITE_CLASSES_V1,
305 description: "Builtin IDM Control for management of schema classes.",
306 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_SCHEMA_ADMINS]),
307 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
308 ProtoFilter::Eq(
309 EntryClass::Class.to_string(),
310 EntryClass::ClassType.to_string()
311 ),
312 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
313 ])),
314 search_attrs: vec![
315 Attribute::Class,
316 Attribute::ClassName,
317 Attribute::Description,
318 Attribute::SystemMay,
319 Attribute::May,
320 Attribute::SystemMust,
321 Attribute::Must,
322 Attribute::Uuid,
323 ],
324 modify_removed_attrs: vec![
325 Attribute::Class,
326 Attribute::Description,
327 Attribute::May,
328 Attribute::Must,
329 ],
330 modify_present_attrs: vec![
331 Attribute::Name,
332 Attribute::Description,
333 Attribute::May,
334 Attribute::Must,
335 ],
336 create_attrs: vec![
337 Attribute::Class,
338 Attribute::ClassName,
339 Attribute::Description,
340 Attribute::May,
341 Attribute::Must,
342 Attribute::Uuid,
343 ],
344 create_classes: vec![EntryClass::Object, EntryClass::ClassType,],
345 ..Default::default()
346 };
347}
348
349lazy_static! {
350 pub static ref IDM_ACP_ACP_MANAGE_V1: BuiltinAcp = BuiltinAcp {
351 classes: vec![
352 EntryClass::Object,
353 EntryClass::AccessControlProfile,
354 EntryClass::AccessControlCreate,
355 EntryClass::AccessControlDelete,
356 EntryClass::AccessControlModify,
357 EntryClass::AccessControlSearch
358 ],
359 name: "idm_acp_acp_manage",
360 uuid: UUID_IDM_ACP_ACP_MANAGE_V1,
361 description: "Builtin IDM Control for access profiles management.",
362 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ACCESS_CONTROL_ADMINS]),
363 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
364 ProtoFilter::Eq(
365 EntryClass::Class.to_string(),
366 EntryClass::AccessControlProfile.to_string()
367 ),
368 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
369 ])),
370 search_attrs: vec![
371 Attribute::Class,
372 Attribute::Name,
373 Attribute::Description,
374 Attribute::AcpEnable,
375 Attribute::AcpReceiverGroup,
376 Attribute::AcpTargetScope,
377 Attribute::AcpSearchAttr,
378 Attribute::AcpModifyRemovedAttr,
379 Attribute::AcpModifyPresentAttr,
380 Attribute::AcpModifyClass,
381 Attribute::AcpCreateClass,
382 Attribute::AcpCreateAttr,
383 ],
384 modify_removed_attrs: vec![
385 Attribute::Class,
386 Attribute::Name,
387 Attribute::Description,
388 Attribute::AcpEnable,
389 Attribute::AcpReceiverGroup,
390 Attribute::AcpTargetScope,
391 Attribute::AcpSearchAttr,
392 Attribute::AcpModifyRemovedAttr,
393 Attribute::AcpModifyPresentAttr,
394 Attribute::AcpModifyClass,
395 Attribute::AcpCreateClass,
396 Attribute::AcpCreateAttr,
397 ],
398 modify_present_attrs: vec![
399 Attribute::Class,
400 Attribute::Name,
401 Attribute::Description,
402 Attribute::AcpEnable,
403 Attribute::AcpReceiverGroup,
404 Attribute::AcpTargetScope,
405 Attribute::AcpSearchAttr,
406 Attribute::AcpModifyRemovedAttr,
407 Attribute::AcpModifyPresentAttr,
408 Attribute::AcpModifyClass,
409 Attribute::AcpCreateClass,
410 Attribute::AcpCreateAttr,
411 ],
412 create_attrs: vec![
413 Attribute::Class,
414 Attribute::Name,
415 Attribute::Description,
416 Attribute::AcpEnable,
417 Attribute::AcpReceiverGroup,
418 Attribute::AcpTargetScope,
419 Attribute::AcpSearchAttr,
420 Attribute::AcpModifyRemovedAttr,
421 Attribute::AcpModifyPresentAttr,
422 Attribute::AcpModifyClass,
423 Attribute::AcpCreateClass,
424 Attribute::AcpCreateAttr,
425 ],
426 modify_classes: vec![
427 EntryClass::AccessControlProfile,
428 EntryClass::AccessControlSearch,
429 EntryClass::AccessControlModify,
430 EntryClass::AccessControlCreate,
431 EntryClass::AccessControlDelete,
432 ],
433 create_classes: vec![
434 EntryClass::AccessControlProfile,
435 EntryClass::AccessControlSearch,
436 EntryClass::AccessControlModify,
437 EntryClass::AccessControlCreate,
438 EntryClass::AccessControlDelete,
439 ],
440 ..Default::default()
441 };
442}
443
444lazy_static! {
445 pub static ref IDM_ACP_GROUP_READ_V1: BuiltinAcp = BuiltinAcp {
446 classes: vec![
447 EntryClass::Object,
448 EntryClass::AccessControlProfile,
449 EntryClass::AccessControlSearch
450 ],
451 name: "idm_acp_group_read",
452 uuid: UUID_IDM_ACP_GROUP_READ,
453 description:
454 "Builtin IDM Control for allowing all groups to be read by access control admins",
455 receiver: BuiltinAcpReceiver::Group(vec![
456 UUID_IDM_ACCESS_CONTROL_ADMINS,
457 ]),
460 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
461 match_class_filter!(EntryClass::Group),
462 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
463 ])),
464 search_attrs: vec![
465 Attribute::Class,
466 Attribute::DynMember,
467 Attribute::Name,
468 Attribute::Uuid,
469 Attribute::Spn,
470 Attribute::Description,
471 Attribute::Member,
472 Attribute::MemberOf,
473 Attribute::EntryManagedBy,
474 ],
475 ..Default::default()
476 };
477}
478
479lazy_static! {
480 pub static ref IDM_ACP_GROUP_ENTRY_MANAGED_BY_MODIFY_V1: BuiltinAcp = BuiltinAcp {
481 classes: vec![
482 EntryClass::Object,
483 EntryClass::AccessControlProfile,
484 EntryClass::AccessControlModify,
485 EntryClass::AccessControlSearch
486 ],
487 name: "idm_acp_group_entry_managed_by_modify",
488 uuid: UUID_IDM_ACP_GROUP_ENTRY_MANAGED_BY_MODIFY,
489 description: "Builtin IDM Control for allowing entry_managed_by to be set on group entries",
490 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ACCESS_CONTROL_ADMINS]),
491 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
492 match_class_filter!(EntryClass::Group),
493 FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE.clone(),
494 ])),
495 search_attrs: vec![
496 Attribute::Class,
497 Attribute::Name,
498 Attribute::Spn,
499 Attribute::Uuid,
500 Attribute::EntryManagedBy,
501 ],
502 modify_removed_attrs: vec![Attribute::EntryManagedBy],
503 modify_present_attrs: vec![Attribute::EntryManagedBy],
504 ..Default::default()
505 };
506}
507
508lazy_static! {
509 pub static ref IDM_ACP_GROUP_ACCOUNT_POLICY_MANAGE_DL6: BuiltinAcp = BuiltinAcp {
510 classes: vec![
511 EntryClass::Object,
512 EntryClass::AccessControlProfile,
513 EntryClass::AccessControlModify,
514 EntryClass::AccessControlSearch
515 ],
516 name: "idm_acp_group_account_policy_manage",
517 uuid: UUID_IDM_ACP_GROUP_ACCOUNT_POLICY_MANAGE,
518 description: "Builtin IDM Control for management of account policy on groups",
519 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ACCOUNT_POLICY_ADMINS]),
520 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
521 match_class_filter!(EntryClass::Group),
522 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
523 ])),
524 search_attrs: vec![
525 Attribute::Class,
526 Attribute::Name,
527 Attribute::Uuid,
528 Attribute::AuthSessionExpiry,
529 Attribute::AuthPasswordMinimumLength,
530 Attribute::CredentialTypeMinimum,
531 Attribute::PrivilegeExpiry,
532 Attribute::WebauthnAttestationCaList,
533 Attribute::LimitSearchMaxResults,
534 Attribute::LimitSearchMaxFilterTest,
535 ],
536 modify_removed_attrs: vec![
537 Attribute::Class,
538 Attribute::AuthSessionExpiry,
539 Attribute::AuthPasswordMinimumLength,
540 Attribute::CredentialTypeMinimum,
541 Attribute::PrivilegeExpiry,
542 Attribute::WebauthnAttestationCaList,
543 Attribute::LimitSearchMaxResults,
544 Attribute::LimitSearchMaxFilterTest,
545 ],
546 modify_present_attrs: vec![
547 Attribute::Class,
548 Attribute::AuthSessionExpiry,
549 Attribute::AuthPasswordMinimumLength,
550 Attribute::CredentialTypeMinimum,
551 Attribute::PrivilegeExpiry,
552 Attribute::WebauthnAttestationCaList,
553 Attribute::LimitSearchMaxResults,
554 Attribute::LimitSearchMaxFilterTest,
555 ],
556 modify_classes: vec![EntryClass::AccountPolicy,],
557 ..Default::default()
558 };
559}
560
561lazy_static! {
562 pub static ref IDM_ACP_GROUP_ACCOUNT_POLICY_MANAGE_DL8: BuiltinAcp = BuiltinAcp {
563 classes: vec![
564 EntryClass::Object,
565 EntryClass::AccessControlProfile,
566 EntryClass::AccessControlModify,
567 EntryClass::AccessControlSearch
568 ],
569 name: "idm_acp_group_account_policy_manage",
570 uuid: UUID_IDM_ACP_GROUP_ACCOUNT_POLICY_MANAGE,
571 description: "Builtin IDM Control for management of account policy on groups",
572 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ACCOUNT_POLICY_ADMINS]),
573 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
574 match_class_filter!(EntryClass::Group),
575 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
576 ])),
577 search_attrs: vec![
578 Attribute::Class,
579 Attribute::Name,
580 Attribute::Uuid,
581 Attribute::AuthSessionExpiry,
582 Attribute::AuthPasswordMinimumLength,
583 Attribute::CredentialTypeMinimum,
584 Attribute::PrivilegeExpiry,
585 Attribute::WebauthnAttestationCaList,
586 Attribute::LimitSearchMaxResults,
587 Attribute::LimitSearchMaxFilterTest,
588 Attribute::AllowPrimaryCredFallback,
589 ],
590 modify_removed_attrs: vec![
591 Attribute::Class,
592 Attribute::AuthSessionExpiry,
593 Attribute::AuthPasswordMinimumLength,
594 Attribute::CredentialTypeMinimum,
595 Attribute::PrivilegeExpiry,
596 Attribute::WebauthnAttestationCaList,
597 Attribute::LimitSearchMaxResults,
598 Attribute::LimitSearchMaxFilterTest,
599 Attribute::AllowPrimaryCredFallback,
600 ],
601 modify_present_attrs: vec![
602 Attribute::Class,
603 Attribute::AuthSessionExpiry,
604 Attribute::AuthPasswordMinimumLength,
605 Attribute::CredentialTypeMinimum,
606 Attribute::PrivilegeExpiry,
607 Attribute::WebauthnAttestationCaList,
608 Attribute::LimitSearchMaxResults,
609 Attribute::LimitSearchMaxFilterTest,
610 Attribute::AllowPrimaryCredFallback,
611 ],
612 modify_classes: vec![EntryClass::AccountPolicy,],
613 ..Default::default()
614 };
615}
616
617lazy_static! {
618 pub static ref IDM_ACP_OAUTH2_MANAGE: BuiltinAcp = BuiltinAcp {
619 classes: vec![
620 EntryClass::Object,
621 EntryClass::AccessControlProfile,
622 EntryClass::AccessControlCreate,
623 EntryClass::AccessControlDelete,
624 EntryClass::AccessControlModify,
625 EntryClass::AccessControlSearch
626 ],
627 name: "idm_acp_oauth2_manage",
628 uuid: UUID_IDM_ACP_OAUTH2_MANAGE_V1,
629 description: "Builtin IDM Control for managing OAuth2 resource server integrations.",
630 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_OAUTH2_ADMINS]),
631 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
632 match_class_filter!(EntryClass::OAuth2ResourceServer),
633 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
634 ])),
635 search_attrs: vec![
636 Attribute::Class,
637 Attribute::Description,
638 Attribute::DisplayName,
639 Attribute::Name,
640 Attribute::Spn,
641 Attribute::OAuth2Session,
642 Attribute::OAuth2RsOrigin,
643 Attribute::OAuth2RsOriginLanding,
644 Attribute::OAuth2RsScopeMap,
645 Attribute::OAuth2RsSupScopeMap,
646 Attribute::OAuth2RsBasicSecret,
647 Attribute::OAuth2AllowInsecureClientDisablePkce,
648 Attribute::OAuth2JwtLegacyCryptoEnable,
649 Attribute::OAuth2PreferShortUsername,
650 Attribute::OAuth2AllowLocalhostRedirect,
651 Attribute::OAuth2RsClaimMap,
652 Attribute::Image,
653 Attribute::OAuth2StrictRedirectUri,
654 Attribute::OAuth2DeviceFlowEnable,
655 Attribute::KeyInternalData,
656 ],
657 modify_removed_attrs: vec![
658 Attribute::Description,
659 Attribute::DisplayName,
660 Attribute::Name,
661 Attribute::OAuth2Session,
662 Attribute::OAuth2RsOrigin,
663 Attribute::OAuth2RsOriginLanding,
664 Attribute::OAuth2RsScopeMap,
665 Attribute::OAuth2RsSupScopeMap,
666 Attribute::OAuth2RsBasicSecret,
667 Attribute::OAuth2AllowInsecureClientDisablePkce,
668 Attribute::OAuth2JwtLegacyCryptoEnable,
669 Attribute::OAuth2PreferShortUsername,
670 Attribute::OAuth2AllowLocalhostRedirect,
671 Attribute::OAuth2RsClaimMap,
672 Attribute::Image,
673 Attribute::OAuth2StrictRedirectUri,
674 Attribute::OAuth2DeviceFlowEnable,
675 Attribute::KeyActionRevoke,
676 Attribute::KeyActionRotate,
677 ],
678 modify_present_attrs: vec![
679 Attribute::Description,
680 Attribute::DisplayName,
681 Attribute::Name,
682 Attribute::OAuth2RsOrigin,
683 Attribute::OAuth2RsOriginLanding,
684 Attribute::OAuth2RsSupScopeMap,
685 Attribute::OAuth2RsScopeMap,
686 Attribute::OAuth2AllowInsecureClientDisablePkce,
687 Attribute::OAuth2JwtLegacyCryptoEnable,
688 Attribute::OAuth2PreferShortUsername,
689 Attribute::OAuth2AllowLocalhostRedirect,
690 Attribute::OAuth2RsClaimMap,
691 Attribute::Image,
692 Attribute::OAuth2StrictRedirectUri,
693 Attribute::OAuth2DeviceFlowEnable,
694 Attribute::KeyActionRevoke,
695 Attribute::KeyActionRotate,
696 ],
697 create_attrs: vec![
698 Attribute::Class,
699 Attribute::Description,
700 Attribute::Name,
701 Attribute::DisplayName,
702 Attribute::OAuth2RsName,
703 Attribute::OAuth2RsOrigin,
704 Attribute::OAuth2RsOriginLanding,
705 Attribute::OAuth2RsSupScopeMap,
706 Attribute::OAuth2RsScopeMap,
707 Attribute::OAuth2AllowInsecureClientDisablePkce,
708 Attribute::OAuth2JwtLegacyCryptoEnable,
709 Attribute::OAuth2PreferShortUsername,
710 Attribute::OAuth2AllowLocalhostRedirect,
711 Attribute::OAuth2RsClaimMap,
712 Attribute::Image,
713 Attribute::OAuth2StrictRedirectUri,
714 Attribute::OAuth2DeviceFlowEnable,
715 ],
716 create_classes: vec![
717 EntryClass::Object,
718 EntryClass::Account,
719 EntryClass::OAuth2ResourceServer,
720 EntryClass::OAuth2ResourceServerBasic,
721 EntryClass::OAuth2ResourceServerPublic,
722 ],
723 ..Default::default()
724 };
725}
726
727lazy_static! {
728 pub static ref IDM_ACP_DOMAIN_ADMIN_DL9: BuiltinAcp = BuiltinAcp {
729 classes: vec![
730 EntryClass::Object,
731 EntryClass::AccessControlProfile,
732 EntryClass::AccessControlModify,
733 EntryClass::AccessControlSearch
734 ],
735 name: "idm_acp_domain_admin",
736 uuid: UUID_IDM_ACP_DOMAIN_ADMIN_V1,
737 description: "Builtin IDM Control for granting domain info administration locally",
738 receiver: BuiltinAcpReceiver::Group(vec![UUID_DOMAIN_ADMINS]),
739 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
740 ProtoFilter::Eq(
741 Attribute::Uuid.to_string(),
742 STR_UUID_DOMAIN_INFO.to_string()
743 ),
744 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
745 ])),
746 search_attrs: vec![
747 Attribute::Class,
748 Attribute::Name,
749 Attribute::Uuid,
750 Attribute::DomainAllowEasterEggs,
751 Attribute::DomainDisplayName,
752 Attribute::DomainName,
753 Attribute::DomainLdapBasedn,
754 Attribute::LdapMaxQueryableAttrs,
755 Attribute::DomainSsid,
756 Attribute::DomainUuid,
757 Attribute::KeyInternalData,
758 Attribute::LdapAllowUnixPwBind,
759 Attribute::Version,
760 Attribute::Image,
761 ],
762 modify_removed_attrs: vec![
763 Attribute::DomainDisplayName,
764 Attribute::DomainSsid,
765 Attribute::DomainLdapBasedn,
766 Attribute::LdapMaxQueryableAttrs,
767 Attribute::DomainAllowEasterEggs,
768 Attribute::LdapAllowUnixPwBind,
769 Attribute::KeyActionRevoke,
770 Attribute::KeyActionRotate,
771 Attribute::Image,
772 ],
773 modify_present_attrs: vec![
774 Attribute::DomainDisplayName,
775 Attribute::DomainLdapBasedn,
776 Attribute::LdapMaxQueryableAttrs,
777 Attribute::DomainSsid,
778 Attribute::DomainAllowEasterEggs,
779 Attribute::LdapAllowUnixPwBind,
780 Attribute::KeyActionRevoke,
781 Attribute::KeyActionRotate,
782 Attribute::Image,
783 ],
784 ..Default::default()
785 };
786}
787
788lazy_static! {
789 pub static ref IDM_ACP_SYNC_ACCOUNT_MANAGE_V1: BuiltinAcp = BuiltinAcp {
790 classes: vec![
791 EntryClass::Object,
792 EntryClass::AccessControlProfile,
793 EntryClass::AccessControlCreate,
794 EntryClass::AccessControlDelete,
795 EntryClass::AccessControlModify,
796 EntryClass::AccessControlSearch,
797 ],
798 name: "idm_acp_sync_account_manage",
799 uuid: UUID_IDM_ACP_SYNC_ACCOUNT_MANAGE_V1,
800 description: "Builtin IDM Control for managing IDM synchronisation accounts / connections",
801 receiver: BuiltinAcpReceiver::Group(vec![UUID_DOMAIN_ADMINS]),
802 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
803 ProtoFilter::Eq(
804 Attribute::Class.to_string(),
805 EntryClass::SyncAccount.to_string()
806 ),
807 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
808 ])),
809 search_attrs: vec![
810 Attribute::Class,
811 Attribute::Uuid,
812 Attribute::Name,
813 Attribute::Description,
814 Attribute::JwsEs256PrivateKey,
815 Attribute::SyncTokenSession,
816 Attribute::SyncCredentialPortal,
817 Attribute::SyncYieldAuthority,
818 Attribute::SyncCookie,
819 ],
820 modify_removed_attrs: vec![
821 Attribute::Name,
822 Attribute::Description,
823 Attribute::JwsEs256PrivateKey,
824 Attribute::SyncTokenSession,
825 Attribute::SyncCredentialPortal,
826 Attribute::SyncCookie,
827 Attribute::SyncYieldAuthority,
828 ],
829 modify_present_attrs: vec![
830 Attribute::Name,
831 Attribute::Description,
832 Attribute::SyncTokenSession,
833 Attribute::SyncCredentialPortal,
834 Attribute::SyncYieldAuthority,
835 ],
836 create_attrs: vec![Attribute::Class, Attribute::Name, Attribute::Description,],
837 create_classes: vec![EntryClass::Object, EntryClass::SyncAccount,],
838 ..Default::default()
839 };
840}
841
842lazy_static! {
843 pub static ref IDM_ACP_GROUP_ENTRY_MANAGER_V1: BuiltinAcp = BuiltinAcp{
844 classes: vec![
845 EntryClass::Object,
846 EntryClass::AccessControlProfile,
847 EntryClass::AccessControlModify,
848 EntryClass::AccessControlSearch
849 ],
850 name: "idm_acp_group_entry_manager",
851 uuid: UUID_IDM_ACP_GROUP_ENTRY_MANAGER_V1,
852 description: "Builtin IDM Control for allowing EntryManager to read and modify groups",
853 receiver: BuiltinAcpReceiver::EntryManager,
854 target: BuiltinAcpTarget::Filter( ProtoFilter::And(vec![
856 match_class_filter!(EntryClass::Group),
857 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
858 ])),
859 search_attrs: vec![
860 Attribute::Class,
861 Attribute::Name,
862 Attribute::Uuid,
863 Attribute::Spn,
864 Attribute::Uuid,
865 Attribute::Description,
866 Attribute::Member,
867 Attribute::DynMember,
868 Attribute::EntryManagedBy,
869 ],
870 modify_present_attrs: vec![
871 Attribute::Description,
872 Attribute::Member,
873 ],
874 modify_removed_attrs: vec![
875 Attribute::Description,
876 Attribute::Member,
877 ],
878 ..Default::default()
879 };
880}
881
882lazy_static! {
883 pub static ref IDM_ACP_RADIUS_SERVERS_V1: BuiltinAcp = BuiltinAcp {
884 classes: vec![
885 EntryClass::Object,
886 EntryClass::AccessControlProfile,
887 EntryClass::AccessControlSearch,
888 ],
889 name: "idm_acp_radius_servers",
890 uuid: UUID_IDM_ACP_RADIUS_SERVERS_V1,
891 description:
892 "Builtin IDM Control for RADIUS servers to read credentials and other needed details.",
893 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_RADIUS_SERVERS]),
894 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
895 ProtoFilter::Pres(EntryClass::Class.to_string()),
896 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
897 ])),
898 search_attrs: vec![
899 Attribute::Class,
900 Attribute::Name,
901 Attribute::DisplayName,
902 Attribute::MemberOf,
903 Attribute::Spn,
904 Attribute::Uuid,
905 Attribute::RadiusSecret,
906 ],
907 ..Default::default()
908 };
909}
910
911lazy_static! {
912 pub static ref IDM_ACP_RADIUS_SECRET_MANAGE_V1: BuiltinAcp = BuiltinAcp {
913 classes: vec![
914 EntryClass::Object,
915 EntryClass::AccessControlProfile,
916 EntryClass::AccessControlModify,
917 EntryClass::AccessControlSearch,
918 ],
919 name: "idm_acp_radius_secret_manage",
920 uuid: UUID_IDM_ACP_RADIUS_SECRET_MANAGE_V1,
921 description: "Builtin IDM Control allowing reads and writes to user radius secrets.",
922 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_RADIUS_ADMINS]),
923 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
924 match_class_filter!(EntryClass::Account),
925 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
926 ])),
927 search_attrs: vec![Attribute::RadiusSecret],
928 modify_present_attrs: vec![Attribute::RadiusSecret],
929 modify_removed_attrs: vec![Attribute::RadiusSecret],
930 ..Default::default()
931 };
932}
933
934lazy_static! {
935 pub static ref IDM_ACP_MAIL_SERVERS_DL8: BuiltinAcp = BuiltinAcp {
936 classes: vec![
937 EntryClass::Object,
938 EntryClass::AccessControlProfile,
939 EntryClass::AccessControlSearch,
940 ],
941 name: "idm_acp_mail_servers",
942 uuid: UUID_IDM_ACP_MAIL_SERVERS,
943 description:
944 "Builtin IDM Control for MAIL servers to read email addresses and other needed attributes.",
945 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_MAIL_SERVERS]),
946 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
947 ProtoFilter::Or(vec![
948 match_class_filter!(EntryClass::Account),
949 match_class_filter!(EntryClass::Group),
950 ]),
951 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
952 ])),
953 search_attrs: vec![
954 Attribute::Class,
955 Attribute::Name,
956 Attribute::Spn,
957 Attribute::Uuid,
958 Attribute::DisplayName,
959 Attribute::Mail,
960 Attribute::Member,
961 Attribute::DynMember,
962 Attribute::MemberOf,
963 Attribute::GidNumber,
964 ],
965 ..Default::default()
966 };
967}
968
969lazy_static! {
970 pub static ref IDM_ACP_PEOPLE_SELF_WRITE_MAIL_V1: BuiltinAcp = BuiltinAcp {
971 classes: vec![
972 EntryClass::Object,
973 EntryClass::AccessControlProfile,
974 EntryClass::AccessControlModify,
975 ],
976 name: "idm_acp_people_self_write_mail",
977 uuid: UUID_IDM_ACP_PEOPLE_SELF_WRITE_MAIL,
978 description: "Builtin IDM Control for self write of mail for people accounts.",
979 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_PEOPLE_SELF_MAIL_WRITE]),
980 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
981 match_class_filter!(EntryClass::Person).clone(),
982 match_class_filter!(EntryClass::Account).clone(),
983 ProtoFilter::SelfUuid,
984 ])),
985 modify_removed_attrs: vec![Attribute::Mail],
986 modify_present_attrs: vec![Attribute::Mail],
987 ..Default::default()
988 };
989}
990
991lazy_static! {
992 pub static ref IDM_ACP_SELF_READ_V1: BuiltinAcp = BuiltinAcp {
993 name: "idm_acp_self_read",
994 uuid: UUID_IDM_ACP_SELF_READ,
995 description:
996 "Builtin IDM Control for self read - required for whoami and many other functions",
997 classes: vec![
998 EntryClass::Object,
999 EntryClass::AccessControlProfile,
1000 EntryClass::AccessControlSearch,
1001 ],
1002 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ALL_ACCOUNTS]),
1003 target: BuiltinAcpTarget::Filter(ProtoFilter::SelfUuid),
1004 search_attrs: vec![
1005 Attribute::Class,
1006 Attribute::Name,
1007 Attribute::Spn,
1008 Attribute::DisplayName,
1009 Attribute::LegalName,
1010 Attribute::Class,
1011 Attribute::MemberOf,
1012 Attribute::Mail,
1013 Attribute::RadiusSecret,
1014 Attribute::GidNumber,
1015 Attribute::LoginShell,
1016 Attribute::Uuid,
1017 Attribute::SyncParentUuid,
1018 Attribute::AccountExpire,
1019 Attribute::AccountValidFrom,
1020 Attribute::PrimaryCredential,
1021 Attribute::UserAuthTokenSession,
1022 Attribute::PassKeys,
1023 Attribute::AttestedPasskeys,
1024 ],
1025 ..Default::default()
1026 };
1027}
1028
1029lazy_static! {
1030 pub static ref IDM_ACP_SELF_READ_DL8: BuiltinAcp = BuiltinAcp {
1031 name: "idm_acp_self_read",
1032 uuid: UUID_IDM_ACP_SELF_READ,
1033 description:
1034 "Builtin IDM Control for self read - required for whoami and many other functions",
1035 classes: vec![
1036 EntryClass::Object,
1037 EntryClass::AccessControlProfile,
1038 EntryClass::AccessControlSearch,
1039 ],
1040 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ALL_ACCOUNTS]),
1041 target: BuiltinAcpTarget::Filter(ProtoFilter::SelfUuid),
1042 search_attrs: vec![
1043 Attribute::Class,
1044 Attribute::Name,
1045 Attribute::Spn,
1046 Attribute::DisplayName,
1047 Attribute::LegalName,
1048 Attribute::Class,
1049 Attribute::MemberOf,
1050 Attribute::Mail,
1051 Attribute::RadiusSecret,
1052 Attribute::GidNumber,
1053 Attribute::LoginShell,
1054 Attribute::Uuid,
1055 Attribute::SyncParentUuid,
1056 Attribute::AccountExpire,
1057 Attribute::AccountValidFrom,
1058 Attribute::PrimaryCredential,
1059 Attribute::UserAuthTokenSession,
1060 Attribute::PassKeys,
1061 Attribute::AttestedPasskeys,
1062 Attribute::ApplicationPassword,
1063 Attribute::SshPublicKey,
1064 Attribute::UnixPassword,
1065 ],
1066 ..Default::default()
1067 };
1068}
1069
1070lazy_static! {
1071 pub static ref IDM_ACP_SELF_WRITE_V1: BuiltinAcp = BuiltinAcp{
1072 name: "idm_acp_self_write",
1073 uuid: UUID_IDM_ACP_SELF_WRITE_V1,
1074 classes: vec![
1075 EntryClass::Object,
1076 EntryClass::AccessControlProfile,
1077 EntryClass::AccessControlModify,
1078 ],
1079 description: "Builtin IDM Control for self write - required for people to update their own identities and credentials in line with best practices.",
1080 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_ALL_PERSONS] ),
1081 target: BuiltinAcpTarget::Filter(ProtoFilter::SelfUuid),
1082 modify_removed_attrs: vec![
1083 Attribute::DisplayName,
1084 Attribute::LegalName,
1085 Attribute::RadiusSecret,
1086 Attribute::PrimaryCredential,
1087 Attribute::SshPublicKey,
1088 Attribute::UnixPassword,
1089 Attribute::PassKeys,
1090 Attribute::AttestedPasskeys,
1091 Attribute::UserAuthTokenSession,
1092 Attribute::ApplicationPassword,
1093 ],
1094 modify_present_attrs: vec![
1095 Attribute::DisplayName,
1096 Attribute::LegalName,
1097 Attribute::RadiusSecret,
1098 Attribute::PrimaryCredential,
1099 Attribute::SshPublicKey,
1100 Attribute::UnixPassword,
1101 Attribute::PassKeys,
1102 Attribute::AttestedPasskeys,
1103 Attribute::ApplicationPassword,
1104 ],
1105 ..Default::default()
1106 };
1107}
1108
1109lazy_static! {
1110 pub static ref IDM_ACP_SELF_WRITE_DL7: BuiltinAcp = BuiltinAcp{
1111 name: "idm_acp_self_write",
1112 uuid: UUID_IDM_ACP_SELF_WRITE_V1,
1113 classes: vec![
1114 EntryClass::Object,
1115 EntryClass::AccessControlProfile,
1116 EntryClass::AccessControlModify,
1117 ],
1118 description: "Builtin IDM Control for self write - required for people to update their own credentials in line with best practices.",
1119 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_ALL_PERSONS] ),
1120 target: BuiltinAcpTarget::Filter(ProtoFilter::SelfUuid),
1121 modify_removed_attrs: vec![
1122 Attribute::RadiusSecret,
1123 Attribute::PrimaryCredential,
1124 Attribute::SshPublicKey,
1125 Attribute::UnixPassword,
1126 Attribute::PassKeys,
1127 Attribute::AttestedPasskeys,
1128 Attribute::UserAuthTokenSession,
1129 ],
1130 modify_present_attrs: vec![
1131 Attribute::RadiusSecret,
1132 Attribute::PrimaryCredential,
1133 Attribute::SshPublicKey,
1134 Attribute::UnixPassword,
1135 Attribute::PassKeys,
1136 Attribute::AttestedPasskeys,
1137 ],
1138 ..Default::default()
1139 };
1140}
1141
1142lazy_static! {
1143 pub static ref IDM_ACP_SELF_WRITE_DL8: BuiltinAcp = BuiltinAcp{
1144 name: "idm_acp_self_write",
1145 uuid: UUID_IDM_ACP_SELF_WRITE_V1,
1146 classes: vec![
1147 EntryClass::Object,
1148 EntryClass::AccessControlProfile,
1149 EntryClass::AccessControlModify,
1150 ],
1151 description: "Builtin IDM Control for self write - required for people to update their own credentials in line with best practices.",
1152 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_ALL_PERSONS] ),
1153 target: BuiltinAcpTarget::Filter(ProtoFilter::SelfUuid),
1154 modify_removed_attrs: vec![
1155 Attribute::RadiusSecret,
1156 Attribute::PrimaryCredential,
1157 Attribute::SshPublicKey,
1158 Attribute::UnixPassword,
1159 Attribute::PassKeys,
1160 Attribute::AttestedPasskeys,
1161 Attribute::UserAuthTokenSession,
1162 Attribute::ApplicationPassword,
1163 ],
1164 modify_present_attrs: vec![
1165 Attribute::RadiusSecret,
1166 Attribute::PrimaryCredential,
1167 Attribute::SshPublicKey,
1168 Attribute::UnixPassword,
1169 Attribute::PassKeys,
1170 Attribute::AttestedPasskeys,
1171 Attribute::ApplicationPassword,
1172 ],
1173 ..Default::default()
1174 };
1175}
1176
1177lazy_static! {
1178 pub static ref IDM_ACP_SELF_NAME_WRITE_V1: BuiltinAcp = BuiltinAcp{
1179 name: "idm_acp_self_name_write",
1180 uuid: UUID_IDM_ACP_SELF_NAME_WRITE_V1,
1181 classes: vec![
1182 EntryClass::Object,
1183 EntryClass::AccessControlProfile,
1184 EntryClass::AccessControlModify,
1185 ],
1186 description: "Builtin IDM Control for self write of name - required for people to update their own identities in line with best practices.",
1187 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_ALL_PERSONS] ),
1188 target: BuiltinAcpTarget::Filter(ProtoFilter::SelfUuid),
1189 modify_removed_attrs: vec![
1190 Attribute::Name,
1191 ],
1192 modify_present_attrs: vec![
1193 Attribute::Name,
1194 ],
1195 ..Default::default()
1196 };
1197}
1198
1199lazy_static! {
1200 pub static ref IDM_ACP_SELF_NAME_WRITE_DL7: BuiltinAcp = BuiltinAcp{
1201 name: "idm_acp_self_name_write",
1202 uuid: UUID_IDM_ACP_SELF_NAME_WRITE_V1,
1203 classes: vec![
1204 EntryClass::Object,
1205 EntryClass::AccessControlProfile,
1206 EntryClass::AccessControlModify,
1207 ],
1208 description: "Builtin IDM Control for self write of name - required for people to update their own identities in line with best practices.",
1209 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_PEOPLE_SELF_NAME_WRITE] ),
1210 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1211 ProtoFilter::SelfUuid,
1212 match_class_filter!(EntryClass::Person).clone(),
1213 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1214 ])),
1215 modify_removed_attrs: vec![
1216 Attribute::Name,
1217 Attribute::DisplayName,
1218 Attribute::LegalName,
1219 ],
1220 modify_present_attrs: vec![
1221 Attribute::Name,
1222 Attribute::DisplayName,
1223 Attribute::LegalName,
1224 ],
1225 ..Default::default()
1226 };
1227}
1228
1229lazy_static! {
1230 pub static ref IDM_ACP_ACCOUNT_SELF_WRITE_V1: BuiltinAcp = BuiltinAcp {
1231 name: "idm_acp_account_self_write",
1232 uuid: UUID_IDM_ACP_ACCOUNT_SELF_WRITE_V1,
1233 description: "Builtin IDM Control for self write - required for accounts to update their own session state.",
1234 classes: vec![
1235 EntryClass::Object,
1236 EntryClass::AccessControlProfile,
1237 EntryClass::AccessControlModify
1238 ],
1239 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_ALL_ACCOUNTS] ),
1240 target: BuiltinAcpTarget::Filter(ProtoFilter::SelfUuid),
1241 modify_removed_attrs: vec![
1242 Attribute::UserAuthTokenSession
1243 ],
1244 ..Default::default()
1245 };
1246}
1247
1248lazy_static! {
1249 pub static ref IDM_ACP_ALL_ACCOUNTS_POSIX_READ_V1: BuiltinAcp = BuiltinAcp {
1250 classes: vec![
1251 EntryClass::Object,
1252 EntryClass::AccessControlProfile,
1253 EntryClass::AccessControlSearch,
1254 ],
1255 name: "idm_acp_all_accounts_posix_read",
1256 uuid: UUID_IDM_ACP_ALL_ACCOUNTS_POSIX_READ_V1,
1257 description:
1258 "Builtin IDM control for reading minimal POSIX attrs. Required for services to authenticate UNIX users.",
1259 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_UNIX_AUTHENTICATION_READ] ),
1260 target: BuiltinAcpTarget::Filter( ProtoFilter::And(
1261 vec![
1262 ProtoFilter::Or(vec![
1263 match_class_filter!(EntryClass::PosixAccount),
1264 match_class_filter!(EntryClass::PosixGroup),
1265 ]),
1266 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1267 ]
1268 )),
1269 search_attrs: vec![
1270 Attribute::Class,
1271 Attribute::Name,
1272 Attribute::Spn,
1273 Attribute::DisplayName,
1274 Attribute::Class,
1275 Attribute::MemberOf,
1276 Attribute::Member,
1277 Attribute::DynMember,
1278 Attribute::Uuid,
1279 Attribute::GidNumber,
1280 Attribute::LoginShell,
1281 Attribute::SshPublicKey,
1282 ],
1283 ..Default::default()
1284 };
1285}
1286
1287lazy_static! {
1288 pub static ref IDM_ACP_ACCOUNT_MAIL_READ_DL6: BuiltinAcp = BuiltinAcp {
1289 classes: vec![
1290 EntryClass::Object,
1291 EntryClass::AccessControlProfile,
1292 EntryClass::AccessControlSearch
1293 ],
1294 name: "idm_acp_account_mail_read",
1295 uuid: UUID_IDM_ACP_ACCOUNT_MAIL_READ_V1,
1296 description: "Builtin IDM Control for reading account and group mail attributes.",
1297 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ACCOUNT_MAIL_READ]),
1298 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1299 ProtoFilter::Or(vec![
1300 match_class_filter!(EntryClass::Account),
1301 match_class_filter!(EntryClass::Group),
1302 ]),
1303 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1304 ])),
1305 search_attrs: vec![Attribute::Mail],
1306 ..Default::default()
1307 };
1308}
1309
1310lazy_static! {
1311 pub static ref IDM_ACP_SYSTEM_CONFIG_ACCOUNT_POLICY_MANAGE_V1: BuiltinAcp = BuiltinAcp {
1312 classes: vec![
1313 EntryClass::Object,
1314 EntryClass::AccessControlProfile,
1315 EntryClass::AccessControlModify,
1316 EntryClass::AccessControlSearch
1317 ],
1318 name: "idm_acp_system_config_account_policy_manage",
1319 uuid: UUID_IDM_ACP_SYSTEM_CONFIG_ACCOUNT_POLICY_MANAGE_V1,
1320 description: "Builtin IDM Control for granting system configuration of account policy",
1321 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ACCOUNT_POLICY_ADMINS]),
1322 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1323 ProtoFilter::Eq(
1324 Attribute::Uuid.to_string(),
1325 STR_UUID_SYSTEM_CONFIG.to_string()
1326 ),
1327 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
1328 ])),
1329 search_attrs: vec![
1330 Attribute::Class,
1331 Attribute::Name,
1332 Attribute::Uuid,
1333 Attribute::Description,
1334 Attribute::BadlistPassword,
1335 Attribute::DeniedName,
1336 Attribute::AuthSessionExpiry,
1337 Attribute::PrivilegeExpiry,
1338 Attribute::Version,
1339 ],
1340 modify_removed_attrs: vec![
1341 Attribute::BadlistPassword,
1342 Attribute::DeniedName,
1343 Attribute::AuthSessionExpiry,
1344 Attribute::PrivilegeExpiry,
1345 ],
1346 modify_present_attrs: vec![
1347 Attribute::BadlistPassword,
1348 Attribute::DeniedName,
1349 Attribute::AuthSessionExpiry,
1350 Attribute::PrivilegeExpiry,
1351 ],
1352 ..Default::default()
1353 };
1354}
1355
1356lazy_static! {
1357 pub static ref IDM_ACP_HP_GROUP_UNIX_MANAGE_V1: BuiltinAcp = BuiltinAcp{
1358 classes: vec![
1359 EntryClass::Object,
1360 EntryClass::AccessControlProfile,
1361 EntryClass::AccessControlModify,
1362 EntryClass::AccessControlSearch
1363 ],
1364 name: "idm_acp_hp_group_unix_manage",
1365 uuid: UUID_IDM_ACP_HP_GROUP_UNIX_MANAGE_V1,
1366 description: "Builtin IDM Control for managing and extending high privilege groups with unix attributes",
1367 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_UNIX_ADMINS] ),
1368 target: BuiltinAcpTarget::Filter( ProtoFilter::And(vec![
1370 match_class_filter!(EntryClass::Group),
1371 FILTER_HP.clone(),
1372 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1373 ])),
1374 search_attrs: vec![
1375 Attribute::DynMember,
1376 Attribute::Class,
1377 Attribute::Name,
1378 Attribute::Uuid,
1379 Attribute::Spn,
1380 Attribute::Description,
1381 Attribute::Member,
1382 Attribute::MemberOf,
1383 Attribute::GidNumber,
1384 ],
1385 modify_removed_attrs: vec![
1386 Attribute::GidNumber,
1387 ],
1388 modify_present_attrs: vec![
1389 Attribute::Class,
1390 Attribute::GidNumber,
1391 ],
1392 modify_classes: vec![
1393 EntryClass::PosixGroup,
1394 ],
1395 ..Default::default()
1396 };
1397}
1398
1399lazy_static! {
1400 pub static ref IDM_ACP_GROUP_MANAGE_DL9: BuiltinAcp = BuiltinAcp{
1401 classes: vec![
1402 EntryClass::Object,
1403 EntryClass::AccessControlProfile,
1404 EntryClass::AccessControlCreate,
1405 EntryClass::AccessControlDelete,
1406 EntryClass::AccessControlModify,
1407 EntryClass::AccessControlSearch
1408 ],
1409 name: "idm_acp_group_manage",
1410 uuid: UUID_IDM_ACP_GROUP_MANAGE_V1,
1411 description: "Builtin IDM Control for creating and deleting groups in the directory",
1412 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_GROUP_ADMINS] ),
1413 target: BuiltinAcpTarget::Filter( ProtoFilter::And(vec![
1415 match_class_filter!(EntryClass::Group),
1416 FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE.clone(),
1417 ])),
1418 search_attrs: vec![
1419 Attribute::Class,
1420 Attribute::Name,
1421 Attribute::Uuid,
1422 Attribute::Spn,
1423 Attribute::Uuid,
1424 Attribute::Description,
1425 Attribute::Mail,
1426 Attribute::Member,
1427 Attribute::MemberOf,
1428 Attribute::DynMember,
1429 Attribute::EntryManagedBy,
1430 ],
1431 create_attrs: vec![
1432 Attribute::Class,
1433 Attribute::Name,
1434 Attribute::Uuid,
1435 Attribute::Description,
1436 Attribute::Mail,
1437 Attribute::Member,
1438 Attribute::EntryManagedBy,
1439 ],
1440 create_classes: vec![
1441 EntryClass::Object,
1442 EntryClass::Group,
1443 ],
1444 modify_present_attrs: vec![
1445 Attribute::Name,
1446 Attribute::Description,
1447 Attribute::Mail,
1448 Attribute::Member,
1449 Attribute::EntryManagedBy,
1450 ],
1451 modify_removed_attrs: vec![
1452 Attribute::Name,
1453 Attribute::Description,
1454 Attribute::Mail,
1455 Attribute::Member,
1456 Attribute::EntryManagedBy,
1457 ],
1458 ..Default::default()
1459 };
1460}
1461
1462lazy_static! {
1463 pub static ref IDM_ACP_GROUP_UNIX_MANAGE_V1: BuiltinAcp = BuiltinAcp {
1464 classes: vec![
1465 EntryClass::Object,
1466 EntryClass::AccessControlProfile,
1467 EntryClass::AccessControlModify,
1468 EntryClass::AccessControlSearch
1469 ],
1470 name: "idm_acp_group_unix_manage",
1471 uuid: UUID_IDM_ACP_GROUP_UNIX_MANAGE_V1,
1472 description: "Builtin IDM Control for managing unix groups",
1473 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_UNIX_ADMINS]),
1474 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1475 match_class_filter!(EntryClass::Group),
1476 FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE.clone(),
1477 ])),
1478 search_attrs: vec![
1479 Attribute::DynMember,
1480 Attribute::Class,
1481 Attribute::Name,
1482 Attribute::Uuid,
1483 Attribute::Spn,
1484 Attribute::Description,
1485 Attribute::Member,
1486 Attribute::GidNumber,
1487 ],
1488 modify_removed_attrs: vec![Attribute::GidNumber,],
1489 modify_present_attrs: vec![Attribute::Class, Attribute::GidNumber,],
1490 modify_classes: vec![EntryClass::PosixGroup,],
1491 ..Default::default()
1492 };
1493}
1494
1495lazy_static! {
1496 pub static ref IDM_ACP_ACCOUNT_UNIX_EXTEND_V1: BuiltinAcp = BuiltinAcp {
1497 classes: vec![
1498 EntryClass::Object,
1499 EntryClass::AccessControlProfile,
1500 EntryClass::AccessControlModify,
1501 EntryClass::AccessControlSearch
1502 ],
1503 name: "idm_acp_account_unix_extend",
1504 uuid: UUID_IDM_ACP_ACCOUNT_UNIX_EXTEND_V1,
1505 description: "Builtin IDM Control for managing and extending unix accounts",
1506 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_UNIX_ADMINS]),
1507 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1508 match_class_filter!(EntryClass::Account),
1509 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1510 ])),
1511 search_attrs: vec![
1512 Attribute::Class,
1513 Attribute::Name,
1514 Attribute::Uuid,
1515 Attribute::Spn,
1516 Attribute::Description,
1517 Attribute::GidNumber,
1518 Attribute::LoginShell,
1519 Attribute::UnixPassword,
1520 Attribute::SshPublicKey,
1521 ],
1522 modify_removed_attrs: vec![
1523 Attribute::GidNumber,
1524 Attribute::LoginShell,
1525 Attribute::UnixPassword,
1526 Attribute::SshPublicKey,
1527 ],
1528 modify_present_attrs: vec![
1529 Attribute::Class,
1530 Attribute::GidNumber,
1531 Attribute::LoginShell,
1532 Attribute::UnixPassword,
1533 Attribute::SshPublicKey,
1534 ],
1535 modify_classes: vec![EntryClass::PosixAccount,],
1536 ..Default::default()
1537 };
1538}
1539
1540lazy_static! {
1541 pub static ref IDM_ACP_PEOPLE_PII_READ_V1: BuiltinAcp = BuiltinAcp {
1542 classes: vec![
1543 EntryClass::Object,
1544 EntryClass::AccessControlProfile,
1545 EntryClass::AccessControlSearch,
1546 ],
1547 name: "idm_acp_people_pii_read",
1548 uuid: UUID_IDM_ACP_PEOPLE_PII_READ_V1,
1549 description: "Builtin IDM Control for reading personal and sensitive data.",
1550 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_PEOPLE_ADMINS, UUID_IDM_PEOPLE_PII_READ]),
1551 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1552 match_class_filter!(EntryClass::Person).clone(),
1553 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1554 ])),
1555 search_attrs: vec![
1556 Attribute::Class,
1557 Attribute::Name,
1558 Attribute::Uuid,
1559 Attribute::Spn,
1560 Attribute::DisplayName,
1561 Attribute::LegalName,
1562 Attribute::Mail,
1563 ],
1564 ..Default::default()
1565 };
1566}
1567
1568lazy_static! {
1569 pub static ref IDM_ACP_PEOPLE_PII_MANAGE_V1: BuiltinAcp = BuiltinAcp {
1570 classes: vec![
1571 EntryClass::Object,
1572 EntryClass::AccessControlProfile,
1573 EntryClass::AccessControlModify
1574 ],
1575 name: "idm_acp_people_pii_manage",
1576 uuid: UUID_IDM_ACP_PEOPLE_PII_MANAGE_V1,
1577 description: "Builtin IDM Control for modifying peoples personal and sensitive data",
1578 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_PEOPLE_ADMINS]),
1579 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1580 match_class_filter!(EntryClass::Person),
1581 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1582 ])),
1583 modify_removed_attrs: vec![
1584 Attribute::Name,
1585 Attribute::DisplayName,
1586 Attribute::LegalName,
1587 Attribute::Mail,
1588 ],
1589 modify_present_attrs: vec![
1590 Attribute::Name,
1591 Attribute::DisplayName,
1592 Attribute::LegalName,
1593 Attribute::Mail,
1594 ],
1595 ..Default::default()
1596 };
1597}
1598
1599lazy_static! {
1600 pub static ref IDM_ACP_PEOPLE_CREATE_DL6: BuiltinAcp = BuiltinAcp {
1601 classes: vec![
1602 EntryClass::Object,
1603 EntryClass::AccessControlProfile,
1604 EntryClass::AccessControlCreate,
1605 ],
1606 name: "idm_acp_people_create",
1607 uuid: UUID_IDM_ACP_PEOPLE_CREATE_V1,
1608 description: "Builtin IDM Control for creating new persons.",
1609 receiver: BuiltinAcpReceiver::Group(vec![
1610 UUID_IDM_PEOPLE_ADMINS,
1611 UUID_IDM_PEOPLE_ON_BOARDING
1612 ]),
1613 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1614 match_class_filter!(EntryClass::Person).clone(),
1615 match_class_filter!(EntryClass::Account).clone(),
1616 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1617 ])),
1618 create_attrs: vec![
1619 Attribute::Class,
1620 Attribute::Uuid,
1621 Attribute::Name,
1622 Attribute::DisplayName,
1623 Attribute::Mail,
1624 Attribute::AccountExpire,
1625 Attribute::AccountValidFrom,
1626 ],
1627 create_classes: vec![EntryClass::Object, EntryClass::Account, EntryClass::Person,],
1628 ..Default::default()
1629 };
1630}
1631
1632lazy_static! {
1633 pub static ref IDM_ACP_PEOPLE_MANAGE_V1: BuiltinAcp = BuiltinAcp {
1634 classes: vec![
1635 EntryClass::Object,
1636 EntryClass::AccessControlProfile,
1637 EntryClass::AccessControlModify,
1638 ],
1639 name: "idm_acp_people_manage",
1640 uuid: UUID_IDM_ACP_PEOPLE_MANAGE_V1,
1641 description: "Builtin IDM Control for management of peoples non sensitive attributes.",
1642 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_PEOPLE_ADMINS]),
1643 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1644 match_class_filter!(EntryClass::Person),
1645 match_class_filter!(EntryClass::Account),
1646 FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE.clone(),
1647 ])),
1648 modify_removed_attrs: vec![Attribute::AccountExpire, Attribute::AccountValidFrom,],
1649 modify_present_attrs: vec![Attribute::AccountExpire, Attribute::AccountValidFrom,],
1650 ..Default::default()
1651 };
1652}
1653
1654lazy_static! {
1656 pub static ref IDM_ACP_PEOPLE_READ_V1: BuiltinAcp = BuiltinAcp {
1657 classes: vec![
1658 EntryClass::Object,
1659 EntryClass::AccessControlProfile,
1660 EntryClass::AccessControlSearch,
1661 ],
1662 name: "idm_acp_people_read",
1663 uuid: UUID_IDM_ACP_PEOPLE_READ_V1,
1664 description: "Builtin IDM Control for reading non-sensitive data.",
1665 receiver: BuiltinAcpReceiver::Group(vec![
1666 UUID_IDM_PEOPLE_ADMINS,
1667 UUID_IDM_PEOPLE_PII_READ,
1668 UUID_IDM_ACCOUNT_MAIL_READ,
1669 UUID_IDM_SERVICE_DESK
1670 ]),
1671 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1672 match_class_filter!(EntryClass::Person).clone(),
1673 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1674 ])),
1675 search_attrs: vec![
1676 Attribute::Class,
1677 Attribute::Name,
1678 Attribute::Spn,
1679 Attribute::Uuid,
1680 Attribute::DisplayName,
1681 Attribute::MemberOf,
1682 Attribute::Uuid,
1683 Attribute::AccountExpire,
1684 Attribute::AccountValidFrom,
1685 ],
1686 ..Default::default()
1687 };
1688}
1689
1690lazy_static! {
1692 pub static ref IDM_ACP_PEOPLE_DELETE_V1: BuiltinAcp = BuiltinAcp {
1693 classes: vec![
1694 EntryClass::Object,
1695 EntryClass::AccessControlProfile,
1696 EntryClass::AccessControlDelete,
1697 ],
1698 name: "idm_acp_people_delete",
1699 uuid: UUID_IDM_ACP_PEOPLE_DELETE_V1,
1700 description: "Builtin IDM Control for deleting persons.",
1701 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_PEOPLE_ADMINS,]),
1702 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1703 match_class_filter!(EntryClass::Person).clone(),
1704 match_class_filter!(EntryClass::Account).clone(),
1705 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1706 ])),
1707 ..Default::default()
1708 };
1709}
1710
1711lazy_static! {
1713 pub static ref IDM_ACP_PEOPLE_CREDENTIAL_RESET_V1: BuiltinAcp = BuiltinAcp {
1714 classes: vec![
1715 EntryClass::Object,
1716 EntryClass::AccessControlProfile,
1717 EntryClass::AccessControlModify,
1718 EntryClass::AccessControlSearch
1719 ],
1720 name: "idm_acp_people_credential_reset",
1721 uuid: UUID_IDM_ACP_PEOPLE_CREDENTIAL_RESET_V1,
1722 description: "Builtin IDM Control for resetting peoples credentials ",
1723 receiver: BuiltinAcpReceiver::Group(vec![
1724 UUID_IDM_PEOPLE_ADMINS,
1725 UUID_IDM_SERVICE_DESK,
1726 UUID_IDM_PEOPLE_ON_BOARDING,
1727 ]),
1728 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1729 match_class_filter!(EntryClass::Person),
1730 match_class_filter!(EntryClass::Account),
1731 FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE.clone(),
1732 ])),
1733 search_attrs: vec![
1734 Attribute::Class,
1735 Attribute::Uuid,
1736 Attribute::Name,
1737 Attribute::Spn,
1738 Attribute::PrimaryCredential,
1739 Attribute::AccountExpire,
1740 Attribute::AccountValidFrom,
1741 Attribute::PassKeys,
1742 Attribute::AttestedPasskeys,
1743 ],
1744 modify_removed_attrs: vec![
1745 Attribute::PrimaryCredential,
1746 Attribute::PassKeys,
1747 Attribute::AttestedPasskeys,
1748 ],
1749 modify_present_attrs: vec![
1750 Attribute::PrimaryCredential,
1751 Attribute::PassKeys,
1752 Attribute::AttestedPasskeys,
1753 ],
1754 ..Default::default()
1755 };
1756}
1757
1758lazy_static! {
1760 pub static ref IDM_ACP_HP_PEOPLE_CREDENTIAL_RESET_V1: BuiltinAcp = BuiltinAcp {
1761 classes: vec![
1762 EntryClass::Object,
1763 EntryClass::AccessControlProfile,
1764 EntryClass::AccessControlModify,
1765 EntryClass::AccessControlSearch
1766 ],
1767 name: "idm_acp_hp_people_credential_reset",
1768 uuid: UUID_IDM_ACP_HP_PEOPLE_CREDENTIAL_RESET_V1,
1769 description: "Builtin IDM Control for resetting high privilege peoples credentials ",
1770 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_PEOPLE_ADMINS,]),
1771 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1772 match_class_filter!(EntryClass::Person),
1773 match_class_filter!(EntryClass::Account),
1774 FILTER_HP.clone(),
1775 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1776 ])),
1777 search_attrs: vec![
1778 Attribute::Class,
1779 Attribute::Uuid,
1780 Attribute::Name,
1781 Attribute::Spn,
1782 Attribute::PrimaryCredential,
1783 Attribute::AccountExpire,
1784 Attribute::AccountValidFrom,
1785 Attribute::PassKeys,
1786 Attribute::AttestedPasskeys,
1787 ],
1788 modify_removed_attrs: vec![
1789 Attribute::PrimaryCredential,
1790 Attribute::AccountExpire,
1791 Attribute::AccountValidFrom,
1792 Attribute::PassKeys,
1793 Attribute::AttestedPasskeys,
1794 ],
1795 modify_present_attrs: vec![
1796 Attribute::PrimaryCredential,
1797 Attribute::AccountExpire,
1798 Attribute::AccountValidFrom,
1799 Attribute::PassKeys,
1800 Attribute::AttestedPasskeys,
1801 ],
1802 ..Default::default()
1803 };
1804}
1805
1806lazy_static! {
1809 pub static ref IDM_ACP_SERVICE_ACCOUNT_CREATE_V1: BuiltinAcp = BuiltinAcp {
1810 classes: vec![
1811 EntryClass::Object,
1812 EntryClass::AccessControlProfile,
1813 EntryClass::AccessControlCreate,
1814 ],
1815 name: "idm_acp_service_account_create",
1816 uuid: UUID_IDM_ACP_SERVICE_ACCOUNT_CREATE_V1,
1817 description: "Builtin IDM Control for creating new service accounts.",
1818 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_SERVICE_ACCOUNT_ADMINS]),
1819 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1820 match_class_filter!(EntryClass::ServiceAccount).clone(),
1821 match_class_filter!(EntryClass::Account).clone(),
1822 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1823 ])),
1824 create_attrs: vec![
1825 Attribute::Class,
1826 Attribute::Name,
1827 Attribute::DisplayName,
1828 Attribute::EntryManagedBy,
1829 Attribute::Description,
1830 Attribute::AccountExpire,
1831 Attribute::AccountValidFrom,
1832 ],
1833 create_classes: vec![
1834 EntryClass::Object,
1835 EntryClass::Account,
1836 EntryClass::ServiceAccount,
1837 ],
1838 ..Default::default()
1839 };
1840}
1841
1842lazy_static! {
1843 pub static ref IDM_ACP_SERVICE_ACCOUNT_MANAGE_V1: BuiltinAcp = BuiltinAcp {
1844 classes: vec![
1845 EntryClass::Object,
1846 EntryClass::AccessControlProfile,
1847 EntryClass::AccessControlModify
1848 ],
1849 name: "idm_acp_service_account_manage",
1850 uuid: UUID_IDM_ACP_SERVICE_ACCOUNT_MANAGE_V1,
1851 description: "Builtin IDM Control for modifying service account data",
1852 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_SERVICE_ACCOUNT_ADMINS]),
1853 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1854 match_class_filter!(EntryClass::ServiceAccount).clone(),
1855 match_class_filter!(EntryClass::Account).clone(),
1856 FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE.clone(),
1857 ])),
1858 modify_removed_attrs: vec![
1859 Attribute::Name,
1860 Attribute::DisplayName,
1861 Attribute::Mail,
1862 Attribute::SshPublicKey,
1863 Attribute::UnixPassword,
1864 Attribute::PrimaryCredential,
1865 Attribute::ApiTokenSession,
1866 Attribute::UserAuthTokenSession,
1867 ],
1868 modify_present_attrs: vec![Attribute::Name, Attribute::DisplayName, Attribute::Mail,],
1869 ..Default::default()
1870 };
1871}
1872
1873lazy_static! {
1874 pub static ref IDM_ACP_SERVICE_ACCOUNT_DELETE_V1: BuiltinAcp = BuiltinAcp {
1875 classes: vec![
1876 EntryClass::Object,
1877 EntryClass::AccessControlProfile,
1878 EntryClass::AccessControlDelete,
1879 ],
1880 name: "idm_acp_service_account_delete",
1881 uuid: UUID_IDM_ACP_SERVICE_ACCOUNT_DELETE_V1,
1882 description: "Builtin IDM Control for deleting service accounts.",
1883 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_SERVICE_ACCOUNT_ADMINS]),
1884 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1885 match_class_filter!(EntryClass::ServiceAccount).clone(),
1886 match_class_filter!(EntryClass::Account).clone(),
1887 FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE.clone(),
1888 ])),
1889 ..Default::default()
1890 };
1891}
1892
1893lazy_static! {
1897 pub static ref IDM_ACP_SERVICE_ACCOUNT_ENTRY_MANAGER_V1: BuiltinAcp = BuiltinAcp{
1898 classes: vec![
1899 EntryClass::Object,
1900 EntryClass::AccessControlProfile,
1901 EntryClass::AccessControlModify,
1902 EntryClass::AccessControlSearch
1903 ],
1904 name: "idm_acp_service_account_entry_manager",
1905 uuid: UUID_IDM_ACP_SERVICE_ACCOUNT_ENTRY_MANAGER_V1,
1906 description: "Builtin IDM Control for allowing entry managers to modify service accounts",
1907 receiver: BuiltinAcpReceiver::EntryManager,
1908 target: BuiltinAcpTarget::Filter( ProtoFilter::And(vec![
1909 match_class_filter!(EntryClass::Account),
1910 match_class_filter!(EntryClass::ServiceAccount),
1911 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1912 ])),
1913 search_attrs: vec![
1914 Attribute::Class,
1915 Attribute::Name,
1916 Attribute::Spn,
1917 Attribute::Uuid,
1918 Attribute::EntryManagedBy,
1919 Attribute::DisplayName,
1920 Attribute::SshPublicKey,
1921 Attribute::GidNumber,
1922 Attribute::LoginShell,
1923 Attribute::UnixPassword,
1924 Attribute::PassKeys,
1925 Attribute::PrimaryCredential,
1926 Attribute::AccountExpire,
1927 Attribute::AccountValidFrom,
1928 Attribute::ApiTokenSession,
1929 Attribute::UserAuthTokenSession,
1930 ],
1931 modify_removed_attrs: vec![
1932 Attribute::DisplayName,
1933 Attribute::SshPublicKey,
1934 Attribute::PrimaryCredential,
1935 Attribute::UnixPassword,
1936 Attribute::PassKeys,
1938 Attribute::AccountExpire,
1939 Attribute::AccountValidFrom,
1940 Attribute::ApiTokenSession,
1941 Attribute::UserAuthTokenSession,
1942 ],
1943 modify_present_attrs: vec![
1944 Attribute::DisplayName,
1945 Attribute::SshPublicKey,
1946 Attribute::PrimaryCredential,
1947 Attribute::AccountExpire,
1950 Attribute::AccountValidFrom,
1951 Attribute::ApiTokenSession,
1952 ],
1953 ..Default::default()
1954 };
1955}
1956
1957lazy_static! {
1959 pub static ref IDM_ACP_SERVICE_ACCOUNT_ENTRY_MANAGED_BY_MODIFY_V1: BuiltinAcp = BuiltinAcp {
1960 classes: vec![
1961 EntryClass::Object,
1962 EntryClass::AccessControlProfile,
1963 EntryClass::AccessControlModify,
1964 EntryClass::AccessControlSearch
1965 ],
1966 name: "idm_acp_service_account_entry_managed_by_modify",
1967 uuid: UUID_IDM_ACP_SERVICE_ACCOUNT_ENTRY_MANAGED_BY_MODIFY,
1968 description:
1969 "Builtin IDM Control for allowing entry_managed_by to be set on service account entries",
1970 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_SERVICE_ACCOUNT_ADMINS]),
1971 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1972 match_class_filter!(EntryClass::ServiceAccount).clone(),
1973 match_class_filter!(EntryClass::Account).clone(),
1974 FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE.clone(),
1975 ])),
1976 search_attrs: vec![
1977 Attribute::Class,
1978 Attribute::Name,
1979 Attribute::Spn,
1980 Attribute::Uuid,
1981 Attribute::EntryManagedBy,
1982 ],
1983 modify_removed_attrs: vec![Attribute::EntryManagedBy],
1984 modify_present_attrs: vec![Attribute::EntryManagedBy],
1985 ..Default::default()
1986 };
1987}
1988
1989lazy_static! {
1990 pub static ref IDM_ACP_HP_SERVICE_ACCOUNT_ENTRY_MANAGED_BY_MODIFY_V1: BuiltinAcp = BuiltinAcp {
1991 classes: vec![
1992 EntryClass::Object,
1993 EntryClass::AccessControlProfile,
1994 EntryClass::AccessControlModify,
1995 EntryClass::AccessControlSearch
1996 ],
1997 name: "idm_acp_hp_service_account_entry_managed_by",
1998 uuid: UUID_IDM_ACP_HP_SERVICE_ACCOUNT_ENTRY_MANAGED_BY_MODIFY,
1999 description: "Builtin IDM Control for allowing entry_managed_by to be set on high priv service account entries",
2000 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ACCESS_CONTROL_ADMINS]),
2001 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
2002 match_class_filter!(EntryClass::ServiceAccount).clone(),
2003 match_class_filter!(EntryClass::Account).clone(),
2004 FILTER_HP.clone(),
2005 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
2006 ])),
2007 search_attrs: vec![
2008 Attribute::Class,
2009 Attribute::Name,
2010 Attribute::Spn,
2011 Attribute::Uuid,
2012 Attribute::EntryManagedBy,
2013 ],
2014 modify_removed_attrs: vec![Attribute::EntryManagedBy],
2015 modify_present_attrs: vec![Attribute::EntryManagedBy],
2016 ..Default::default()
2017 };
2018}
2019
2020lazy_static! {
2021 pub static ref IDM_ACP_HP_CLIENT_CERTIFICATE_MANAGER_DL7: BuiltinAcp = BuiltinAcp {
2022 classes: vec![
2023 EntryClass::Object,
2024 EntryClass::AccessControlProfile,
2025 EntryClass::AccessControlCreate,
2026 EntryClass::AccessControlDelete,
2027 EntryClass::AccessControlModify,
2028 EntryClass::AccessControlSearch
2029 ],
2030 name: "idm_acp_hp_client_certificate_manager",
2031 uuid: UUID_IDM_ACP_HP_CLIENT_CERTIFICATE_MANAGER,
2032 description: "Builtin IDM Control for allowing client certificate management.",
2033 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_CLIENT_CERTIFICATE_ADMINS]),
2034 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
2035 ProtoFilter::Eq(
2036 EntryClass::Class.to_string(),
2037 EntryClass::ClientCertificate.to_string()
2038 ),
2039 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
2040 ])),
2041 search_attrs: vec![
2042 Attribute::Class,
2043 Attribute::Uuid,
2044 Attribute::Certificate,
2045 Attribute::Refers,
2046 ],
2047 modify_removed_attrs: vec![Attribute::Certificate, Attribute::Refers,],
2048 modify_present_attrs: vec![Attribute::Certificate, Attribute::Refers,],
2049 create_attrs: vec![Attribute::Class, Attribute::Certificate, Attribute::Refers,],
2050 create_classes: vec![EntryClass::Object, EntryClass::ClientCertificate,],
2051 ..Default::default()
2052 };
2053}
2054
2055lazy_static! {
2056 pub static ref IDM_ACP_APPLICATION_MANAGE_DL8: BuiltinAcp = BuiltinAcp{
2057 classes: vec![
2058 EntryClass::Object,
2059 EntryClass::AccessControlProfile,
2060 EntryClass::AccessControlCreate,
2061 EntryClass::AccessControlDelete,
2062 EntryClass::AccessControlModify,
2063 EntryClass::AccessControlSearch
2064 ],
2065 name: "idm_acp_application_manage",
2066 uuid: UUID_IDM_ACP_APPLICATION_MANAGE,
2067 description: "Builtin IDM Control for creating and deleting applications in the directory",
2068 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_APPLICATION_ADMINS] ),
2069 target: BuiltinAcpTarget::Filter( ProtoFilter::And(vec![
2071 match_class_filter!(EntryClass::Application),
2072 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
2073 ])),
2074 search_attrs: vec![
2075 Attribute::Class,
2076 Attribute::Uuid,
2077 Attribute::Name,
2078 Attribute::Description,
2079 Attribute::DisplayName,
2080 Attribute::Mail,
2081 Attribute::UnixPassword,
2082 Attribute::ApiTokenSession,
2083 Attribute::UserAuthTokenSession,
2084 Attribute::LinkedGroup,
2085 Attribute::EntryManagedBy,
2086 ],
2087 create_attrs: vec![
2088 Attribute::Class,
2089 Attribute::Uuid,
2090 Attribute::Name,
2091 Attribute::Description,
2092 Attribute::DisplayName,
2093 Attribute::Mail,
2094 Attribute::LinkedGroup,
2095 Attribute::EntryManagedBy,
2096 ],
2097 create_classes: vec![
2098 EntryClass::Object,
2099 EntryClass::Account,
2100 EntryClass::ServiceAccount,
2101 EntryClass::Application,
2102 ],
2103 modify_present_attrs: vec![
2104 Attribute::Name,
2105 Attribute::Description,
2106 Attribute::DisplayName,
2107 Attribute::Mail,
2108 Attribute::UnixPassword,
2109 Attribute::ApiTokenSession,
2110 Attribute::LinkedGroup,
2111 Attribute::EntryManagedBy,
2112 ],
2113 modify_removed_attrs: vec![
2114 Attribute::Name,
2115 Attribute::Description,
2116 Attribute::DisplayName,
2117 Attribute::Mail,
2118 Attribute::UnixPassword,
2119 Attribute::ApiTokenSession,
2120 Attribute::UserAuthTokenSession,
2121 Attribute::LinkedGroup,
2122 Attribute::EntryManagedBy,
2123 ],
2124 ..Default::default()
2125 };
2126}
2127
2128lazy_static! {
2129 pub static ref IDM_ACP_APPLICATION_ENTRY_MANAGER_DL8: BuiltinAcp = BuiltinAcp {
2130 classes: vec![
2131 EntryClass::Object,
2132 EntryClass::AccessControlProfile,
2133 EntryClass::AccessControlModify,
2134 EntryClass::AccessControlSearch
2135 ],
2136 name: "idm_acp_application_entry_manager",
2137 uuid: UUID_IDM_ACP_APPLICATION_ENTRY_MANAGER,
2138 description: "Builtin IDM Control for allowing EntryManager to read and modify applications",
2139 receiver: BuiltinAcpReceiver::EntryManager,
2140 target: BuiltinAcpTarget::Filter( ProtoFilter::And(vec![
2142 match_class_filter!(EntryClass::Application),
2143 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
2144 ])),
2145 search_attrs: vec![
2146 Attribute::Class,
2147 Attribute::Uuid,
2148 Attribute::Name,
2149 Attribute::DisplayName,
2150 Attribute::Mail,
2151 Attribute::UnixPassword,
2152 Attribute::ApiTokenSession,
2153 Attribute::UserAuthTokenSession,
2154 Attribute::Description,
2155 Attribute::LinkedGroup,
2156 Attribute::EntryManagedBy,
2157 ],
2158 modify_present_attrs: vec![
2159 Attribute::Name,
2160 Attribute::Description,
2161 Attribute::DisplayName,
2162 Attribute::Mail,
2163 Attribute::UnixPassword,
2164 Attribute::ApiTokenSession,
2165 Attribute::LinkedGroup,
2166 ],
2167 modify_removed_attrs: vec![
2168 Attribute::Name,
2169 Attribute::Description,
2170 Attribute::DisplayName,
2171 Attribute::Mail,
2172 Attribute::UnixPassword,
2173 Attribute::ApiTokenSession,
2174 Attribute::UserAuthTokenSession,
2175 Attribute::LinkedGroup,
2176 ],
2177 ..Default::default()
2178 };
2179}