1#![allow(clippy::expect_used)]
2use crate::constants::uuids::*;
5use crate::entry::EntryInitNew;
6use crate::prelude::*;
7use crate::value::Value;
8use kanidm_proto::internal::Filter as ProtoFilter;
9
10lazy_static! {
11 pub static ref FILTER_RECYCLED_OR_TOMBSTONE: ProtoFilter = ProtoFilter::Or(vec![
13 match_class_filter!(EntryClass::Recycled),
14 match_class_filter!(EntryClass::Tombstone),
15 ]);
16
17 pub static ref FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED: ProtoFilter =
19 ProtoFilter::AndNot(Box::new(FILTER_RECYCLED_OR_TOMBSTONE.clone()));
20
21 pub static ref FILTER_HP: ProtoFilter = ProtoFilter::Eq(
23 Attribute::MemberOf.to_string(),
24 UUID_IDM_HIGH_PRIVILEGE.to_string(),
25 );
26
27 pub static ref FILTER_HP_OR_RECYCLED_OR_TOMBSTONE: ProtoFilter = ProtoFilter::Or(vec![
29 FILTER_HP.clone(),
30 match_class_filter!(EntryClass::Recycled),
31 match_class_filter!(EntryClass::Tombstone),
32 ]);
33
34 pub static ref FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE: ProtoFilter =
35 ProtoFilter::AndNot(Box::new(FILTER_HP_OR_RECYCLED_OR_TOMBSTONE.clone()));
36
37 pub static ref DEFAULT_TARGET_SCOPE: ProtoFilter = ProtoFilter::And(Vec::with_capacity(0));
38
39}
40
41#[derive(Clone, Debug, Default)]
42pub enum BuiltinAcpReceiver {
44 #[default]
45 None,
46 Group(Vec<Uuid>),
49 EntryManager,
50}
51
52#[derive(Clone, Debug, Default)]
53pub enum BuiltinAcpTarget {
55 #[default]
56 None,
57 Filter(ProtoFilter),
59 }
61
62#[derive(Clone, Debug, Default)]
63pub struct BuiltinAcp {
65 classes: Vec<EntryClass>,
66 pub name: &'static str,
67 uuid: Uuid,
68 description: &'static str,
69 receiver: BuiltinAcpReceiver,
70 target: BuiltinAcpTarget,
71 search_attrs: Vec<Attribute>,
72 modify_present_attrs: Vec<Attribute>,
73 modify_removed_attrs: Vec<Attribute>,
74 modify_classes: Vec<EntryClass>,
75 create_classes: Vec<EntryClass>,
76 create_attrs: Vec<Attribute>,
77}
78
79impl From<BuiltinAcp> for EntryInitNew {
80 #[allow(clippy::panic)]
81 fn from(value: BuiltinAcp) -> Self {
82 let mut entry = EntryInitNew::default();
83
84 #[allow(clippy::panic)]
85 if value.name.is_empty() {
86 panic!("Builtin ACP has no name! {:?}", value);
87 }
88 #[allow(clippy::panic)]
89 if value.classes.is_empty() {
90 panic!("Builtin ACP has no classes! {:?}", value);
91 }
92
93 value.classes.iter().for_each(|class| {
94 entry.add_ava(Attribute::Class, class.to_value());
95 });
96
97 entry.set_ava(Attribute::Name, [Value::new_iname(value.name)]);
98
99 if value.uuid >= DYNAMIC_RANGE_MINIMUM_UUID {
100 panic!("Builtin ACP has invalid UUID! {:?}", value);
101 }
102
103 entry.set_ava(Attribute::Uuid, [Value::Uuid(value.uuid)]);
104 entry.set_ava(
105 Attribute::Description,
106 [Value::new_utf8s(value.description)],
107 );
108
109 match &value.receiver {
110 #[allow(clippy::panic)]
111 BuiltinAcpReceiver::None => {
112 panic!("Builtin ACP has no receiver! {:?}", &value);
113 }
114 BuiltinAcpReceiver::Group(list) => {
115 entry.add_ava(
116 Attribute::Class,
117 EntryClass::AccessControlReceiverGroup.to_value(),
118 );
119 for group in list {
120 entry.set_ava(Attribute::AcpReceiverGroup, [Value::Refer(*group)]);
121 }
122 }
123 BuiltinAcpReceiver::EntryManager => {
124 entry.add_ava(
125 Attribute::Class,
126 EntryClass::AccessControlReceiverEntryManager.to_value(),
127 );
128 }
129 };
130
131 match &value.target {
132 #[allow(clippy::panic)]
133 BuiltinAcpTarget::None => {
134 panic!("Builtin ACP has no target! {:?}", &value);
135 }
136 BuiltinAcpTarget::Filter(proto_filter) => {
137 entry.add_ava(
138 Attribute::Class,
139 EntryClass::AccessControlTargetScope.to_value(),
140 );
141 entry.set_ava(
142 Attribute::AcpTargetScope,
143 [Value::JsonFilt(proto_filter.clone())],
144 );
145 }
146 }
147
148 entry.set_ava(
149 Attribute::AcpSearchAttr,
150 value
151 .search_attrs
152 .into_iter()
153 .map(Value::from)
154 .collect::<Vec<Value>>(),
155 );
156 value.modify_present_attrs.into_iter().for_each(|attr| {
157 entry.add_ava(Attribute::AcpModifyPresentAttr, Value::from(attr));
158 });
159 value.modify_removed_attrs.into_iter().for_each(|attr| {
160 entry.add_ava(Attribute::AcpModifyRemovedAttr, Value::from(attr));
161 });
162 value.modify_classes.into_iter().for_each(|class| {
163 entry.add_ava(Attribute::AcpModifyClass, Value::from(class));
164 });
165 value.create_classes.into_iter().for_each(|class| {
166 entry.add_ava(Attribute::AcpCreateClass, Value::from(class));
167 });
168 value.create_attrs.into_iter().for_each(|attr| {
169 entry.add_ava(Attribute::AcpCreateAttr, Value::from(attr));
170 });
171 entry
172 }
173}
174
175lazy_static! {
176 pub static ref IDM_ACP_RECYCLE_BIN_SEARCH_V1: BuiltinAcp = BuiltinAcp {
177 uuid: UUID_IDM_ACP_RECYCLE_BIN_SEARCH_V1,
178 name: "idm_acp_recycle_bin_search",
179 description: "Builtin IDM recycle bin search permission.",
180 classes: vec![
181 EntryClass::Object,
182 EntryClass::AccessControlProfile,
183 EntryClass::AccessControlSearch,
184 ],
185 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_RECYCLE_BIN_ADMINS]),
186 target: BuiltinAcpTarget::Filter(ProtoFilter::Eq(
187 Attribute::Class.to_string(),
188 ATTR_RECYCLED.to_string()
189 )),
190
191 search_attrs: vec![
192 Attribute::Class,
193 Attribute::Name,
194 Attribute::Uuid,
195 Attribute::LastModifiedCid,
196 ],
197 ..Default::default()
198 };
199}
200
201lazy_static! {
202 pub static ref IDM_ACP_RECYCLE_BIN_REVIVE_V1: BuiltinAcp = BuiltinAcp {
203 uuid: UUID_IDM_ACP_RECYCLE_BIN_REVIVE_V1,
204 name: "idm_acp_recycle_bin_revive",
205 description: "Builtin IDM recycle bin revive permission.",
206 classes: vec![
207 EntryClass::Object,
208 EntryClass::AccessControlProfile,
209 EntryClass::AccessControlModify,
210 ],
211 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_RECYCLE_BIN_ADMINS]),
212 target: BuiltinAcpTarget::Filter(ProtoFilter::Eq(
213 Attribute::Class.to_string(),
214 ATTR_RECYCLED.to_string()
215 )),
216 modify_removed_attrs: vec![Attribute::Class],
217 modify_classes: vec![EntryClass::Recycled],
218 ..Default::default()
219 };
220}
221
222lazy_static! {
223 pub static ref IDM_ACP_SCHEMA_WRITE_ATTRS_V1: BuiltinAcp = BuiltinAcp{
224 classes: vec![
225 EntryClass::Object,
226 EntryClass::AccessControlProfile,
227 EntryClass::AccessControlCreate,
228 EntryClass::AccessControlModify,
229 EntryClass::AccessControlSearch
230 ],
231 name: "idm_acp_schema_write_attrs",
232 uuid: UUID_IDM_ACP_SCHEMA_WRITE_ATTRS_V1,
233 description: "Builtin IDM Control for management of schema attributes.",
234 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_SCHEMA_ADMINS] ),
235 target: BuiltinAcpTarget::Filter( ProtoFilter::And(vec![
237 ProtoFilter::Eq(EntryClass::Class.to_string(),EntryClass::AttributeType.to_string()),
238 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
239 ])),
240 search_attrs: vec![
241 Attribute::Class,
242 Attribute::Description,
243 Attribute::Index,
244 Attribute::Unique,
245 Attribute::MultiValue,
246 Attribute::AttributeName,
247 Attribute::Syntax,
248 Attribute::Uuid,
249 ],
250 modify_removed_attrs: vec![
251 Attribute::Description,
252 Attribute::Index,
253 Attribute::Unique,
254 Attribute::MultiValue,
255 Attribute::Syntax,
256 ],
257 modify_present_attrs: vec![
258 Attribute::Description,
259 Attribute::Index,
260 Attribute::Unique,
261 Attribute::MultiValue,
262 Attribute::Syntax,
263 ],
264 create_attrs: vec![
265 Attribute::Class,
266 Attribute::Description,
267 Attribute::Index,
268 Attribute::Unique,
269 Attribute::MultiValue,
270 Attribute::AttributeName,
271 Attribute::Syntax,
272 Attribute::Uuid,
273 ],
274 create_classes: vec![
275 EntryClass::Object,
276 EntryClass::AttributeType,
277 ],
278 ..Default::default()
279 };
280}
281
282lazy_static! {
283 pub static ref IDM_ACP_SCHEMA_WRITE_CLASSES_V1: BuiltinAcp = BuiltinAcp {
284 classes: vec![
285 EntryClass::Object,
286 EntryClass::AccessControlProfile,
287 EntryClass::AccessControlCreate,
288 EntryClass::AccessControlModify,
289 EntryClass::AccessControlSearch
290 ],
291 name: "idm_acp_schema_write_classes",
292 uuid: UUID_IDM_ACP_SCHEMA_WRITE_CLASSES_V1,
293 description: "Builtin IDM Control for management of schema classes.",
294 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_SCHEMA_ADMINS]),
295 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
296 ProtoFilter::Eq(
297 EntryClass::Class.to_string(),
298 EntryClass::ClassType.to_string()
299 ),
300 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
301 ])),
302 search_attrs: vec![
303 Attribute::Class,
304 Attribute::ClassName,
305 Attribute::Description,
306 Attribute::SystemMay,
307 Attribute::May,
308 Attribute::SystemMust,
309 Attribute::Must,
310 Attribute::Uuid,
311 ],
312 modify_removed_attrs: vec![
313 Attribute::Class,
314 Attribute::Description,
315 Attribute::May,
316 Attribute::Must,
317 ],
318 modify_present_attrs: vec![
319 Attribute::Name,
320 Attribute::Description,
321 Attribute::May,
322 Attribute::Must,
323 ],
324 create_attrs: vec![
325 Attribute::Class,
326 Attribute::ClassName,
327 Attribute::Description,
328 Attribute::May,
329 Attribute::Must,
330 Attribute::Uuid,
331 ],
332 create_classes: vec![EntryClass::Object, EntryClass::ClassType,],
333 ..Default::default()
334 };
335}
336
337lazy_static! {
338 pub static ref IDM_ACP_ACP_MANAGE_V1: BuiltinAcp = BuiltinAcp {
339 classes: vec![
340 EntryClass::Object,
341 EntryClass::AccessControlProfile,
342 EntryClass::AccessControlCreate,
343 EntryClass::AccessControlDelete,
344 EntryClass::AccessControlModify,
345 EntryClass::AccessControlSearch
346 ],
347 name: "idm_acp_acp_manage",
348 uuid: UUID_IDM_ACP_ACP_MANAGE_V1,
349 description: "Builtin IDM Control for access profiles management.",
350 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ACCESS_CONTROL_ADMINS]),
351 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
352 ProtoFilter::Eq(
353 EntryClass::Class.to_string(),
354 EntryClass::AccessControlProfile.to_string()
355 ),
356 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
357 ])),
358 search_attrs: vec![
359 Attribute::Class,
360 Attribute::Name,
361 Attribute::Description,
362 Attribute::AcpEnable,
363 Attribute::AcpReceiverGroup,
364 Attribute::AcpTargetScope,
365 Attribute::AcpSearchAttr,
366 Attribute::AcpModifyRemovedAttr,
367 Attribute::AcpModifyPresentAttr,
368 Attribute::AcpModifyClass,
369 Attribute::AcpCreateClass,
370 Attribute::AcpCreateAttr,
371 ],
372 modify_removed_attrs: vec![
373 Attribute::Class,
374 Attribute::Name,
375 Attribute::Description,
376 Attribute::AcpEnable,
377 Attribute::AcpReceiverGroup,
378 Attribute::AcpTargetScope,
379 Attribute::AcpSearchAttr,
380 Attribute::AcpModifyRemovedAttr,
381 Attribute::AcpModifyPresentAttr,
382 Attribute::AcpModifyClass,
383 Attribute::AcpCreateClass,
384 Attribute::AcpCreateAttr,
385 ],
386 modify_present_attrs: vec![
387 Attribute::Class,
388 Attribute::Name,
389 Attribute::Description,
390 Attribute::AcpEnable,
391 Attribute::AcpReceiverGroup,
392 Attribute::AcpTargetScope,
393 Attribute::AcpSearchAttr,
394 Attribute::AcpModifyRemovedAttr,
395 Attribute::AcpModifyPresentAttr,
396 Attribute::AcpModifyClass,
397 Attribute::AcpCreateClass,
398 Attribute::AcpCreateAttr,
399 ],
400 create_attrs: vec![
401 Attribute::Class,
402 Attribute::Name,
403 Attribute::Description,
404 Attribute::AcpEnable,
405 Attribute::AcpReceiverGroup,
406 Attribute::AcpTargetScope,
407 Attribute::AcpSearchAttr,
408 Attribute::AcpModifyRemovedAttr,
409 Attribute::AcpModifyPresentAttr,
410 Attribute::AcpModifyClass,
411 Attribute::AcpCreateClass,
412 Attribute::AcpCreateAttr,
413 ],
414 modify_classes: vec![
415 EntryClass::AccessControlProfile,
416 EntryClass::AccessControlSearch,
417 EntryClass::AccessControlModify,
418 EntryClass::AccessControlCreate,
419 EntryClass::AccessControlDelete,
420 ],
421 create_classes: vec![
422 EntryClass::AccessControlProfile,
423 EntryClass::AccessControlSearch,
424 EntryClass::AccessControlModify,
425 EntryClass::AccessControlCreate,
426 EntryClass::AccessControlDelete,
427 ],
428 };
429}
430
431lazy_static! {
432 pub static ref IDM_ACP_GROUP_READ_V1: BuiltinAcp = BuiltinAcp {
433 classes: vec![
434 EntryClass::Object,
435 EntryClass::AccessControlProfile,
436 EntryClass::AccessControlSearch
437 ],
438 name: "idm_acp_group_read",
439 uuid: UUID_IDM_ACP_GROUP_READ,
440 description:
441 "Builtin IDM Control for allowing all groups to be read by access control admins",
442 receiver: BuiltinAcpReceiver::Group(vec![
443 UUID_IDM_ACCESS_CONTROL_ADMINS,
444 ]),
447 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
448 match_class_filter!(EntryClass::Group),
449 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
450 ])),
451 search_attrs: vec![
452 Attribute::Class,
453 Attribute::DynMember,
454 Attribute::Name,
455 Attribute::Uuid,
456 Attribute::Spn,
457 Attribute::Description,
458 Attribute::Member,
459 Attribute::EntryManagedBy,
460 ],
461 ..Default::default()
462 };
463}
464
465lazy_static! {
466 pub static ref IDM_ACP_GROUP_ENTRY_MANAGED_BY_MODIFY_V1: BuiltinAcp = BuiltinAcp {
467 classes: vec![
468 EntryClass::Object,
469 EntryClass::AccessControlProfile,
470 EntryClass::AccessControlModify,
471 EntryClass::AccessControlSearch
472 ],
473 name: "idm_acp_group_entry_managed_by_modify",
474 uuid: UUID_IDM_ACP_GROUP_ENTRY_MANAGED_BY_MODIFY,
475 description: "Builtin IDM Control for allowing entry_managed_by to be set on group entries",
476 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ACCESS_CONTROL_ADMINS]),
477 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
478 match_class_filter!(EntryClass::Group),
479 FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE.clone(),
480 ])),
481 search_attrs: vec![
482 Attribute::Class,
483 Attribute::Name,
484 Attribute::Spn,
485 Attribute::Uuid,
486 Attribute::EntryManagedBy,
487 ],
488 modify_removed_attrs: vec![Attribute::EntryManagedBy],
489 modify_present_attrs: vec![Attribute::EntryManagedBy],
490 ..Default::default()
491 };
492}
493
494lazy_static! {
495 pub static ref IDM_ACP_GROUP_ACCOUNT_POLICY_MANAGE_DL6: BuiltinAcp = BuiltinAcp {
496 classes: vec![
497 EntryClass::Object,
498 EntryClass::AccessControlProfile,
499 EntryClass::AccessControlModify,
500 EntryClass::AccessControlSearch
501 ],
502 name: "idm_acp_group_account_policy_manage",
503 uuid: UUID_IDM_ACP_GROUP_ACCOUNT_POLICY_MANAGE,
504 description: "Builtin IDM Control for management of account policy on groups",
505 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ACCOUNT_POLICY_ADMINS]),
506 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
507 match_class_filter!(EntryClass::Group),
508 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
509 ])),
510 search_attrs: vec![
511 Attribute::Class,
512 Attribute::Name,
513 Attribute::Uuid,
514 Attribute::AuthSessionExpiry,
515 Attribute::AuthPasswordMinimumLength,
516 Attribute::CredentialTypeMinimum,
517 Attribute::PrivilegeExpiry,
518 Attribute::WebauthnAttestationCaList,
519 Attribute::LimitSearchMaxResults,
520 Attribute::LimitSearchMaxFilterTest,
521 ],
522 modify_removed_attrs: vec![
523 Attribute::Class,
524 Attribute::AuthSessionExpiry,
525 Attribute::AuthPasswordMinimumLength,
526 Attribute::CredentialTypeMinimum,
527 Attribute::PrivilegeExpiry,
528 Attribute::WebauthnAttestationCaList,
529 Attribute::LimitSearchMaxResults,
530 Attribute::LimitSearchMaxFilterTest,
531 ],
532 modify_present_attrs: vec![
533 Attribute::Class,
534 Attribute::AuthSessionExpiry,
535 Attribute::AuthPasswordMinimumLength,
536 Attribute::CredentialTypeMinimum,
537 Attribute::PrivilegeExpiry,
538 Attribute::WebauthnAttestationCaList,
539 Attribute::LimitSearchMaxResults,
540 Attribute::LimitSearchMaxFilterTest,
541 ],
542 modify_classes: vec![EntryClass::AccountPolicy,],
543 ..Default::default()
544 };
545}
546
547lazy_static! {
548 pub static ref IDM_ACP_GROUP_ACCOUNT_POLICY_MANAGE_DL8: BuiltinAcp = BuiltinAcp {
549 classes: vec![
550 EntryClass::Object,
551 EntryClass::AccessControlProfile,
552 EntryClass::AccessControlModify,
553 EntryClass::AccessControlSearch
554 ],
555 name: "idm_acp_group_account_policy_manage",
556 uuid: UUID_IDM_ACP_GROUP_ACCOUNT_POLICY_MANAGE,
557 description: "Builtin IDM Control for management of account policy on groups",
558 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ACCOUNT_POLICY_ADMINS]),
559 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
560 match_class_filter!(EntryClass::Group),
561 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
562 ])),
563 search_attrs: vec![
564 Attribute::Class,
565 Attribute::Name,
566 Attribute::Uuid,
567 Attribute::AuthSessionExpiry,
568 Attribute::AuthPasswordMinimumLength,
569 Attribute::CredentialTypeMinimum,
570 Attribute::PrivilegeExpiry,
571 Attribute::WebauthnAttestationCaList,
572 Attribute::LimitSearchMaxResults,
573 Attribute::LimitSearchMaxFilterTest,
574 Attribute::AllowPrimaryCredFallback,
575 ],
576 modify_removed_attrs: vec![
577 Attribute::Class,
578 Attribute::AuthSessionExpiry,
579 Attribute::AuthPasswordMinimumLength,
580 Attribute::CredentialTypeMinimum,
581 Attribute::PrivilegeExpiry,
582 Attribute::WebauthnAttestationCaList,
583 Attribute::LimitSearchMaxResults,
584 Attribute::LimitSearchMaxFilterTest,
585 Attribute::AllowPrimaryCredFallback,
586 ],
587 modify_present_attrs: vec![
588 Attribute::Class,
589 Attribute::AuthSessionExpiry,
590 Attribute::AuthPasswordMinimumLength,
591 Attribute::CredentialTypeMinimum,
592 Attribute::PrivilegeExpiry,
593 Attribute::WebauthnAttestationCaList,
594 Attribute::LimitSearchMaxResults,
595 Attribute::LimitSearchMaxFilterTest,
596 Attribute::AllowPrimaryCredFallback,
597 ],
598 modify_classes: vec![EntryClass::AccountPolicy,],
599 ..Default::default()
600 };
601}
602
603lazy_static! {
604 pub static ref IDM_ACP_OAUTH2_MANAGE_DL4: BuiltinAcp = BuiltinAcp {
605 classes: vec![
606 EntryClass::Object,
607 EntryClass::AccessControlProfile,
608 EntryClass::AccessControlCreate,
609 EntryClass::AccessControlDelete,
610 EntryClass::AccessControlModify,
611 EntryClass::AccessControlSearch
612 ],
613 name: "idm_acp_hp_oauth2_manage_priv",
614 uuid: UUID_IDM_ACP_OAUTH2_MANAGE_V1,
615 description: "Builtin IDM Control for managing oauth2 resource server integrations.",
616 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_OAUTH2_ADMINS]),
617 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
618 match_class_filter!(EntryClass::OAuth2ResourceServer),
619 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
620 ])),
621 search_attrs: vec![
622 Attribute::Class,
623 Attribute::Description,
624 Attribute::DisplayName,
625 Attribute::OAuth2RsName,
626 Attribute::OAuth2RsOrigin,
627 Attribute::OAuth2RsOriginLanding,
628 Attribute::OAuth2RsScopeMap,
629 Attribute::OAuth2RsSupScopeMap,
630 Attribute::OAuth2RsBasicSecret,
631 Attribute::OAuth2RsTokenKey,
632 Attribute::Es256PrivateKeyDer,
633 Attribute::OAuth2AllowInsecureClientDisablePkce,
634 Attribute::Rs256PrivateKeyDer,
635 Attribute::OAuth2JwtLegacyCryptoEnable,
636 Attribute::OAuth2PreferShortUsername,
637 Attribute::OAuth2AllowLocalhostRedirect,
638 Attribute::OAuth2RsClaimMap,
639 Attribute::Image,
640 ],
641 modify_removed_attrs: vec![
642 Attribute::Description,
643 Attribute::DisplayName,
644 Attribute::OAuth2RsName,
645 Attribute::OAuth2RsOrigin,
646 Attribute::OAuth2RsOriginLanding,
647 Attribute::OAuth2RsScopeMap,
648 Attribute::OAuth2RsSupScopeMap,
649 Attribute::OAuth2RsBasicSecret,
650 Attribute::OAuth2RsTokenKey,
651 Attribute::Es256PrivateKeyDer,
652 Attribute::OAuth2AllowInsecureClientDisablePkce,
653 Attribute::Rs256PrivateKeyDer,
654 Attribute::OAuth2JwtLegacyCryptoEnable,
655 Attribute::OAuth2PreferShortUsername,
656 Attribute::OAuth2AllowLocalhostRedirect,
657 Attribute::OAuth2RsClaimMap,
658 Attribute::Image,
659 ],
660 modify_present_attrs: vec![
661 Attribute::Description,
662 Attribute::DisplayName,
663 Attribute::OAuth2RsName,
664 Attribute::OAuth2RsOrigin,
665 Attribute::OAuth2RsOriginLanding,
666 Attribute::OAuth2RsSupScopeMap,
667 Attribute::OAuth2RsScopeMap,
668 Attribute::OAuth2AllowInsecureClientDisablePkce,
669 Attribute::OAuth2JwtLegacyCryptoEnable,
670 Attribute::OAuth2PreferShortUsername,
671 Attribute::OAuth2AllowLocalhostRedirect,
672 Attribute::OAuth2RsClaimMap,
673 Attribute::Image,
674 ],
675 create_attrs: vec![
676 Attribute::Class,
677 Attribute::Description,
678 Attribute::DisplayName,
679 Attribute::OAuth2RsName,
680 Attribute::OAuth2RsOrigin,
681 Attribute::OAuth2RsOriginLanding,
682 Attribute::OAuth2RsSupScopeMap,
683 Attribute::OAuth2RsScopeMap,
684 Attribute::OAuth2AllowInsecureClientDisablePkce,
685 Attribute::OAuth2JwtLegacyCryptoEnable,
686 Attribute::OAuth2PreferShortUsername,
687 Attribute::OAuth2AllowLocalhostRedirect,
688 Attribute::OAuth2RsClaimMap,
689 Attribute::Image,
690 ],
691 create_classes: vec![
692 EntryClass::Object,
693 EntryClass::OAuth2ResourceServer,
694 EntryClass::OAuth2ResourceServerBasic,
695 EntryClass::OAuth2ResourceServerPublic,
696 ],
697 ..Default::default()
698 };
699}
700
701lazy_static! {
702 pub static ref IDM_ACP_OAUTH2_MANAGE_DL5: BuiltinAcp = BuiltinAcp {
703 classes: vec![
704 EntryClass::Object,
705 EntryClass::AccessControlProfile,
706 EntryClass::AccessControlCreate,
707 EntryClass::AccessControlDelete,
708 EntryClass::AccessControlModify,
709 EntryClass::AccessControlSearch
710 ],
711 name: "idm_acp_hp_oauth2_manage_priv",
712 uuid: UUID_IDM_ACP_OAUTH2_MANAGE_V1,
713 description: "Builtin IDM Control for managing oauth2 resource server integrations.",
714 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_OAUTH2_ADMINS]),
715 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
716 match_class_filter!(EntryClass::OAuth2ResourceServer),
717 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
718 ])),
719 search_attrs: vec![
720 Attribute::Class,
721 Attribute::Description,
722 Attribute::DisplayName,
723 Attribute::Name,
724 Attribute::Spn,
725 Attribute::OAuth2Session,
726 Attribute::OAuth2RsOrigin,
727 Attribute::OAuth2RsOriginLanding,
728 Attribute::OAuth2RsScopeMap,
729 Attribute::OAuth2RsSupScopeMap,
730 Attribute::OAuth2RsBasicSecret,
731 Attribute::OAuth2RsTokenKey,
732 Attribute::Es256PrivateKeyDer,
733 Attribute::OAuth2AllowInsecureClientDisablePkce,
734 Attribute::Rs256PrivateKeyDer,
735 Attribute::OAuth2JwtLegacyCryptoEnable,
736 Attribute::OAuth2PreferShortUsername,
737 Attribute::OAuth2AllowLocalhostRedirect,
738 Attribute::OAuth2RsClaimMap,
739 Attribute::Image,
740 ],
741 modify_removed_attrs: vec![
742 Attribute::Description,
743 Attribute::DisplayName,
744 Attribute::Name,
745 Attribute::OAuth2Session,
746 Attribute::OAuth2RsOrigin,
747 Attribute::OAuth2RsOriginLanding,
748 Attribute::OAuth2RsScopeMap,
749 Attribute::OAuth2RsSupScopeMap,
750 Attribute::OAuth2RsBasicSecret,
751 Attribute::OAuth2RsTokenKey,
752 Attribute::Es256PrivateKeyDer,
753 Attribute::OAuth2AllowInsecureClientDisablePkce,
754 Attribute::Rs256PrivateKeyDer,
755 Attribute::OAuth2JwtLegacyCryptoEnable,
756 Attribute::OAuth2PreferShortUsername,
757 Attribute::OAuth2AllowLocalhostRedirect,
758 Attribute::OAuth2RsClaimMap,
759 Attribute::Image,
760 ],
761 modify_present_attrs: vec![
762 Attribute::Description,
763 Attribute::DisplayName,
764 Attribute::Name,
765 Attribute::OAuth2RsOrigin,
766 Attribute::OAuth2RsOriginLanding,
767 Attribute::OAuth2RsSupScopeMap,
768 Attribute::OAuth2RsScopeMap,
769 Attribute::OAuth2AllowInsecureClientDisablePkce,
770 Attribute::OAuth2JwtLegacyCryptoEnable,
771 Attribute::OAuth2PreferShortUsername,
772 Attribute::OAuth2AllowLocalhostRedirect,
773 Attribute::OAuth2RsClaimMap,
774 Attribute::Image,
775 ],
776 create_attrs: vec![
777 Attribute::Class,
778 Attribute::Description,
779 Attribute::Name,
780 Attribute::DisplayName,
781 Attribute::OAuth2RsName,
782 Attribute::OAuth2RsOrigin,
783 Attribute::OAuth2RsOriginLanding,
784 Attribute::OAuth2RsSupScopeMap,
785 Attribute::OAuth2RsScopeMap,
786 Attribute::OAuth2AllowInsecureClientDisablePkce,
787 Attribute::OAuth2JwtLegacyCryptoEnable,
788 Attribute::OAuth2PreferShortUsername,
789 Attribute::OAuth2AllowLocalhostRedirect,
790 Attribute::OAuth2RsClaimMap,
791 Attribute::Image,
792 ],
793 create_classes: vec![
794 EntryClass::Object,
795 EntryClass::Account,
796 EntryClass::OAuth2ResourceServer,
797 EntryClass::OAuth2ResourceServerBasic,
798 EntryClass::OAuth2ResourceServerPublic,
799 ],
800 ..Default::default()
801 };
802}
803
804lazy_static! {
805 pub static ref IDM_ACP_OAUTH2_MANAGE_DL7: BuiltinAcp = BuiltinAcp {
806 classes: vec![
807 EntryClass::Object,
808 EntryClass::AccessControlProfile,
809 EntryClass::AccessControlCreate,
810 EntryClass::AccessControlDelete,
811 EntryClass::AccessControlModify,
812 EntryClass::AccessControlSearch
813 ],
814 name: "idm_acp_hp_oauth2_manage_priv",
815 uuid: UUID_IDM_ACP_OAUTH2_MANAGE_V1,
816 description: "Builtin IDM Control for managing oauth2 resource server integrations.",
817 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_OAUTH2_ADMINS]),
818 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
819 match_class_filter!(EntryClass::OAuth2ResourceServer),
820 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
821 ])),
822 search_attrs: vec![
823 Attribute::Class,
824 Attribute::Description,
825 Attribute::DisplayName,
826 Attribute::Name,
827 Attribute::Spn,
828 Attribute::OAuth2Session,
829 Attribute::OAuth2RsOrigin,
830 Attribute::OAuth2RsOriginLanding,
831 Attribute::OAuth2RsScopeMap,
832 Attribute::OAuth2RsSupScopeMap,
833 Attribute::OAuth2RsBasicSecret,
834 Attribute::OAuth2RsTokenKey,
835 Attribute::Es256PrivateKeyDer,
836 Attribute::OAuth2AllowInsecureClientDisablePkce,
837 Attribute::Rs256PrivateKeyDer,
838 Attribute::OAuth2JwtLegacyCryptoEnable,
839 Attribute::OAuth2PreferShortUsername,
840 Attribute::OAuth2AllowLocalhostRedirect,
841 Attribute::OAuth2RsClaimMap,
842 Attribute::Image,
843 Attribute::OAuth2StrictRedirectUri,
844 ],
845 modify_removed_attrs: vec![
846 Attribute::Description,
847 Attribute::DisplayName,
848 Attribute::Name,
849 Attribute::OAuth2Session,
850 Attribute::OAuth2RsOrigin,
851 Attribute::OAuth2RsOriginLanding,
852 Attribute::OAuth2RsScopeMap,
853 Attribute::OAuth2RsSupScopeMap,
854 Attribute::OAuth2RsBasicSecret,
855 Attribute::OAuth2RsTokenKey,
856 Attribute::Es256PrivateKeyDer,
857 Attribute::OAuth2AllowInsecureClientDisablePkce,
858 Attribute::Rs256PrivateKeyDer,
859 Attribute::OAuth2JwtLegacyCryptoEnable,
860 Attribute::OAuth2PreferShortUsername,
861 Attribute::OAuth2AllowLocalhostRedirect,
862 Attribute::OAuth2RsClaimMap,
863 Attribute::Image,
864 Attribute::OAuth2StrictRedirectUri,
865 ],
866 modify_present_attrs: vec![
867 Attribute::Description,
868 Attribute::DisplayName,
869 Attribute::Name,
870 Attribute::OAuth2RsOrigin,
871 Attribute::OAuth2RsOriginLanding,
872 Attribute::OAuth2RsSupScopeMap,
873 Attribute::OAuth2RsScopeMap,
874 Attribute::OAuth2AllowInsecureClientDisablePkce,
875 Attribute::OAuth2JwtLegacyCryptoEnable,
876 Attribute::OAuth2PreferShortUsername,
877 Attribute::OAuth2AllowLocalhostRedirect,
878 Attribute::OAuth2RsClaimMap,
879 Attribute::Image,
880 Attribute::OAuth2StrictRedirectUri,
881 ],
882 create_attrs: vec![
883 Attribute::Class,
884 Attribute::Description,
885 Attribute::Name,
886 Attribute::DisplayName,
887 Attribute::OAuth2RsName,
888 Attribute::OAuth2RsOrigin,
889 Attribute::OAuth2RsOriginLanding,
890 Attribute::OAuth2RsSupScopeMap,
891 Attribute::OAuth2RsScopeMap,
892 Attribute::OAuth2AllowInsecureClientDisablePkce,
893 Attribute::OAuth2JwtLegacyCryptoEnable,
894 Attribute::OAuth2PreferShortUsername,
895 Attribute::OAuth2AllowLocalhostRedirect,
896 Attribute::OAuth2RsClaimMap,
897 Attribute::Image,
898 Attribute::OAuth2StrictRedirectUri,
899 ],
900 create_classes: vec![
901 EntryClass::Object,
902 EntryClass::Account,
903 EntryClass::OAuth2ResourceServer,
904 EntryClass::OAuth2ResourceServerBasic,
905 EntryClass::OAuth2ResourceServerPublic,
906 ],
907 ..Default::default()
908 };
909}
910
911lazy_static! {
912 pub static ref IDM_ACP_OAUTH2_MANAGE_DL9: BuiltinAcp = BuiltinAcp {
913 classes: vec![
914 EntryClass::Object,
915 EntryClass::AccessControlProfile,
916 EntryClass::AccessControlCreate,
917 EntryClass::AccessControlDelete,
918 EntryClass::AccessControlModify,
919 EntryClass::AccessControlSearch
920 ],
921 name: "idm_acp_oauth2_manage",
922 uuid: UUID_IDM_ACP_OAUTH2_MANAGE_V1,
923 description: "Builtin IDM Control for managing OAuth2 resource server integrations.",
924 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_OAUTH2_ADMINS]),
925 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
926 match_class_filter!(EntryClass::OAuth2ResourceServer),
927 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
928 ])),
929 search_attrs: vec![
930 Attribute::Class,
931 Attribute::Description,
932 Attribute::DisplayName,
933 Attribute::Name,
934 Attribute::Spn,
935 Attribute::OAuth2Session,
936 Attribute::OAuth2RsOrigin,
937 Attribute::OAuth2RsOriginLanding,
938 Attribute::OAuth2RsScopeMap,
939 Attribute::OAuth2RsSupScopeMap,
940 Attribute::OAuth2RsBasicSecret,
941 Attribute::OAuth2RsTokenKey,
942 Attribute::Es256PrivateKeyDer,
943 Attribute::OAuth2AllowInsecureClientDisablePkce,
944 Attribute::Rs256PrivateKeyDer,
945 Attribute::OAuth2JwtLegacyCryptoEnable,
946 Attribute::OAuth2PreferShortUsername,
947 Attribute::OAuth2AllowLocalhostRedirect,
948 Attribute::OAuth2RsClaimMap,
949 Attribute::Image,
950 Attribute::OAuth2StrictRedirectUri,
951 Attribute::OAuth2DeviceFlowEnable,
952 ],
953 modify_removed_attrs: vec![
954 Attribute::Description,
955 Attribute::DisplayName,
956 Attribute::Name,
957 Attribute::OAuth2Session,
958 Attribute::OAuth2RsOrigin,
959 Attribute::OAuth2RsOriginLanding,
960 Attribute::OAuth2RsScopeMap,
961 Attribute::OAuth2RsSupScopeMap,
962 Attribute::OAuth2RsBasicSecret,
963 Attribute::OAuth2RsTokenKey,
964 Attribute::Es256PrivateKeyDer,
965 Attribute::OAuth2AllowInsecureClientDisablePkce,
966 Attribute::Rs256PrivateKeyDer,
967 Attribute::OAuth2JwtLegacyCryptoEnable,
968 Attribute::OAuth2PreferShortUsername,
969 Attribute::OAuth2AllowLocalhostRedirect,
970 Attribute::OAuth2RsClaimMap,
971 Attribute::Image,
972 Attribute::OAuth2StrictRedirectUri,
973 Attribute::OAuth2DeviceFlowEnable,
974 ],
975 modify_present_attrs: vec![
976 Attribute::Description,
977 Attribute::DisplayName,
978 Attribute::Name,
979 Attribute::OAuth2RsOrigin,
980 Attribute::OAuth2RsOriginLanding,
981 Attribute::OAuth2RsSupScopeMap,
982 Attribute::OAuth2RsScopeMap,
983 Attribute::OAuth2AllowInsecureClientDisablePkce,
984 Attribute::OAuth2JwtLegacyCryptoEnable,
985 Attribute::OAuth2PreferShortUsername,
986 Attribute::OAuth2AllowLocalhostRedirect,
987 Attribute::OAuth2RsClaimMap,
988 Attribute::Image,
989 Attribute::OAuth2StrictRedirectUri,
990 Attribute::OAuth2DeviceFlowEnable,
991 ],
992 create_attrs: vec![
993 Attribute::Class,
994 Attribute::Description,
995 Attribute::Name,
996 Attribute::DisplayName,
997 Attribute::OAuth2RsName,
998 Attribute::OAuth2RsOrigin,
999 Attribute::OAuth2RsOriginLanding,
1000 Attribute::OAuth2RsSupScopeMap,
1001 Attribute::OAuth2RsScopeMap,
1002 Attribute::OAuth2AllowInsecureClientDisablePkce,
1003 Attribute::OAuth2JwtLegacyCryptoEnable,
1004 Attribute::OAuth2PreferShortUsername,
1005 Attribute::OAuth2AllowLocalhostRedirect,
1006 Attribute::OAuth2RsClaimMap,
1007 Attribute::Image,
1008 Attribute::OAuth2StrictRedirectUri,
1009 Attribute::OAuth2DeviceFlowEnable,
1010 ],
1011 create_classes: vec![
1012 EntryClass::Object,
1013 EntryClass::Account,
1014 EntryClass::OAuth2ResourceServer,
1015 EntryClass::OAuth2ResourceServerBasic,
1016 EntryClass::OAuth2ResourceServerPublic,
1017 ],
1018 ..Default::default()
1019 };
1020}
1021
1022lazy_static! {
1023 pub static ref IDM_ACP_DOMAIN_ADMIN_DL6: BuiltinAcp = BuiltinAcp {
1024 classes: vec![
1025 EntryClass::Object,
1026 EntryClass::AccessControlProfile,
1027 EntryClass::AccessControlModify,
1028 EntryClass::AccessControlSearch
1029 ],
1030 name: "idm_acp_domain_admin",
1031 uuid: UUID_IDM_ACP_DOMAIN_ADMIN_V1,
1032 description: "Builtin IDM Control for granting domain info administration locally",
1033 receiver: BuiltinAcpReceiver::Group(vec![UUID_DOMAIN_ADMINS]),
1034 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1035 ProtoFilter::Eq(
1036 Attribute::Uuid.to_string(),
1037 STR_UUID_DOMAIN_INFO.to_string()
1038 ),
1039 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
1040 ])),
1041 search_attrs: vec![
1042 Attribute::Class,
1043 Attribute::Name,
1044 Attribute::Uuid,
1045 Attribute::DomainDisplayName,
1046 Attribute::DomainName,
1047 Attribute::DomainLdapBasedn,
1048 Attribute::DomainSsid,
1049 Attribute::DomainUuid,
1050 Attribute::KeyInternalData,
1054 Attribute::LdapAllowUnixPwBind,
1055 Attribute::Version,
1056 ],
1057 modify_removed_attrs: vec![
1058 Attribute::DomainDisplayName,
1059 Attribute::DomainSsid,
1060 Attribute::DomainLdapBasedn,
1061 Attribute::LdapAllowUnixPwBind,
1062 Attribute::KeyActionRevoke,
1063 Attribute::KeyActionRotate,
1064 ],
1065 modify_present_attrs: vec![
1066 Attribute::DomainDisplayName,
1067 Attribute::DomainLdapBasedn,
1068 Attribute::DomainSsid,
1069 Attribute::LdapAllowUnixPwBind,
1070 Attribute::KeyActionRevoke,
1071 Attribute::KeyActionRotate,
1072 ],
1073 ..Default::default()
1074 };
1075}
1076
1077lazy_static! {
1078 pub static ref IDM_ACP_DOMAIN_ADMIN_DL8: BuiltinAcp = BuiltinAcp {
1079 classes: vec![
1080 EntryClass::Object,
1081 EntryClass::AccessControlProfile,
1082 EntryClass::AccessControlModify,
1083 EntryClass::AccessControlSearch
1084 ],
1085 name: "idm_acp_domain_admin",
1086 uuid: UUID_IDM_ACP_DOMAIN_ADMIN_V1,
1087 description: "Builtin IDM Control for granting domain info administration locally",
1088 receiver: BuiltinAcpReceiver::Group(vec![UUID_DOMAIN_ADMINS]),
1089 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1090 ProtoFilter::Eq(
1091 Attribute::Uuid.to_string(),
1092 STR_UUID_DOMAIN_INFO.to_string()
1093 ),
1094 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
1095 ])),
1096 search_attrs: vec![
1097 Attribute::Class,
1098 Attribute::Name,
1099 Attribute::Uuid,
1100 Attribute::DomainDisplayName,
1101 Attribute::DomainName,
1102 Attribute::DomainLdapBasedn,
1103 Attribute::DomainSsid,
1104 Attribute::DomainUuid,
1105 Attribute::KeyInternalData,
1106 Attribute::LdapAllowUnixPwBind,
1107 Attribute::Version,
1108 Attribute::Image,
1109 ],
1110 modify_removed_attrs: vec![
1111 Attribute::DomainDisplayName,
1112 Attribute::DomainSsid,
1113 Attribute::DomainLdapBasedn,
1114 Attribute::LdapAllowUnixPwBind,
1115 Attribute::KeyActionRevoke,
1116 Attribute::KeyActionRotate,
1117 Attribute::Image,
1118 ],
1119 modify_present_attrs: vec![
1120 Attribute::DomainDisplayName,
1121 Attribute::DomainLdapBasedn,
1122 Attribute::DomainSsid,
1123 Attribute::LdapAllowUnixPwBind,
1124 Attribute::KeyActionRevoke,
1125 Attribute::KeyActionRotate,
1126 Attribute::Image,
1127 ],
1128 ..Default::default()
1129 };
1130}
1131
1132lazy_static! {
1133 pub static ref IDM_ACP_DOMAIN_ADMIN_DL9: BuiltinAcp = BuiltinAcp {
1134 classes: vec![
1135 EntryClass::Object,
1136 EntryClass::AccessControlProfile,
1137 EntryClass::AccessControlModify,
1138 EntryClass::AccessControlSearch
1139 ],
1140 name: "idm_acp_domain_admin",
1141 uuid: UUID_IDM_ACP_DOMAIN_ADMIN_V1,
1142 description: "Builtin IDM Control for granting domain info administration locally",
1143 receiver: BuiltinAcpReceiver::Group(vec![UUID_DOMAIN_ADMINS]),
1144 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1145 ProtoFilter::Eq(
1146 Attribute::Uuid.to_string(),
1147 STR_UUID_DOMAIN_INFO.to_string()
1148 ),
1149 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
1150 ])),
1151 search_attrs: vec![
1152 Attribute::Class,
1153 Attribute::Name,
1154 Attribute::Uuid,
1155 Attribute::DomainAllowEasterEggs,
1156 Attribute::DomainDisplayName,
1157 Attribute::DomainName,
1158 Attribute::DomainLdapBasedn,
1159 Attribute::DomainSsid,
1160 Attribute::DomainUuid,
1161 Attribute::KeyInternalData,
1162 Attribute::LdapAllowUnixPwBind,
1163 Attribute::Version,
1164 Attribute::Image,
1165 ],
1166 modify_removed_attrs: vec![
1167 Attribute::DomainDisplayName,
1168 Attribute::DomainSsid,
1169 Attribute::DomainLdapBasedn,
1170 Attribute::DomainAllowEasterEggs,
1171 Attribute::LdapAllowUnixPwBind,
1172 Attribute::KeyActionRevoke,
1173 Attribute::KeyActionRotate,
1174 Attribute::Image,
1175 ],
1176 modify_present_attrs: vec![
1177 Attribute::DomainDisplayName,
1178 Attribute::DomainLdapBasedn,
1179 Attribute::DomainSsid,
1180 Attribute::DomainAllowEasterEggs,
1181 Attribute::LdapAllowUnixPwBind,
1182 Attribute::KeyActionRevoke,
1183 Attribute::KeyActionRotate,
1184 Attribute::Image,
1185 ],
1186 ..Default::default()
1187 };
1188}
1189
1190lazy_static! {
1191 pub static ref IDM_ACP_SYNC_ACCOUNT_MANAGE_V1: BuiltinAcp = BuiltinAcp {
1192 classes: vec![
1193 EntryClass::Object,
1194 EntryClass::AccessControlProfile,
1195 EntryClass::AccessControlCreate,
1196 EntryClass::AccessControlDelete,
1197 EntryClass::AccessControlModify,
1198 EntryClass::AccessControlSearch,
1199 ],
1200 name: "idm_acp_sync_account_manage",
1201 uuid: UUID_IDM_ACP_SYNC_ACCOUNT_MANAGE_V1,
1202 description: "Builtin IDM Control for managing IDM synchronisation accounts / connections",
1203 receiver: BuiltinAcpReceiver::Group(vec![UUID_DOMAIN_ADMINS]),
1204 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1205 ProtoFilter::Eq(
1206 Attribute::Class.to_string(),
1207 EntryClass::SyncAccount.to_string()
1208 ),
1209 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1210 ])),
1211 search_attrs: vec![
1212 Attribute::Class,
1213 Attribute::Uuid,
1214 Attribute::Name,
1215 Attribute::Description,
1216 Attribute::JwsEs256PrivateKey,
1217 Attribute::SyncTokenSession,
1218 Attribute::SyncCredentialPortal,
1219 Attribute::SyncYieldAuthority,
1220 Attribute::SyncCookie,
1221 ],
1222 modify_removed_attrs: vec![
1223 Attribute::Name,
1224 Attribute::Description,
1225 Attribute::JwsEs256PrivateKey,
1226 Attribute::SyncTokenSession,
1227 Attribute::SyncCredentialPortal,
1228 Attribute::SyncCookie,
1229 Attribute::SyncYieldAuthority,
1230 ],
1231 modify_present_attrs: vec![
1232 Attribute::Name,
1233 Attribute::Description,
1234 Attribute::SyncTokenSession,
1235 Attribute::SyncCredentialPortal,
1236 Attribute::SyncYieldAuthority,
1237 ],
1238 create_attrs: vec![Attribute::Class, Attribute::Name, Attribute::Description,],
1239 create_classes: vec![EntryClass::Object, EntryClass::SyncAccount,],
1240 ..Default::default()
1241 };
1242}
1243
1244lazy_static! {
1245 pub static ref IDM_ACP_GROUP_ENTRY_MANAGER_V1: BuiltinAcp = BuiltinAcp{
1246 classes: vec![
1247 EntryClass::Object,
1248 EntryClass::AccessControlProfile,
1249 EntryClass::AccessControlModify,
1250 EntryClass::AccessControlSearch
1251 ],
1252 name: "idm_acp_group_entry_manager",
1253 uuid: UUID_IDM_ACP_GROUP_ENTRY_MANAGER_V1,
1254 description: "Builtin IDM Control for allowing EntryManager to read and modify groups",
1255 receiver: BuiltinAcpReceiver::EntryManager,
1256 target: BuiltinAcpTarget::Filter( ProtoFilter::And(vec![
1258 match_class_filter!(EntryClass::Group),
1259 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
1260 ])),
1261 search_attrs: vec![
1262 Attribute::Class,
1263 Attribute::Name,
1264 Attribute::Uuid,
1265 Attribute::Spn,
1266 Attribute::Uuid,
1267 Attribute::Description,
1268 Attribute::Member,
1269 Attribute::DynMember,
1270 Attribute::EntryManagedBy,
1271 ],
1272 modify_present_attrs: vec![
1273 Attribute::Description,
1274 Attribute::Member,
1275 ],
1276 modify_removed_attrs: vec![
1277 Attribute::Description,
1278 Attribute::Member,
1279 ],
1280 ..Default::default()
1281 };
1282}
1283
1284lazy_static! {
1285 pub static ref IDM_ACP_RADIUS_SERVERS_V1: BuiltinAcp = BuiltinAcp {
1286 classes: vec![
1287 EntryClass::Object,
1288 EntryClass::AccessControlProfile,
1289 EntryClass::AccessControlSearch,
1290 ],
1291 name: "idm_acp_radius_servers",
1292 uuid: UUID_IDM_ACP_RADIUS_SERVERS_V1,
1293 description:
1294 "Builtin IDM Control for RADIUS servers to read credentials and other needed details.",
1295 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_RADIUS_SERVERS]),
1296 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1297 ProtoFilter::Pres(EntryClass::Class.to_string()),
1298 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
1299 ])),
1300 search_attrs: vec![
1301 Attribute::Class,
1302 Attribute::Name,
1303 Attribute::Spn,
1304 Attribute::Uuid,
1305 Attribute::RadiusSecret,
1306 ],
1307 ..Default::default()
1308 };
1309}
1310
1311lazy_static! {
1312 pub static ref IDM_ACP_RADIUS_SECRET_MANAGE_V1: BuiltinAcp = BuiltinAcp {
1313 classes: vec![
1314 EntryClass::Object,
1315 EntryClass::AccessControlProfile,
1316 EntryClass::AccessControlModify,
1317 EntryClass::AccessControlSearch,
1318 ],
1319 name: "idm_acp_radius_secret_manage",
1320 uuid: UUID_IDM_ACP_RADIUS_SECRET_MANAGE_V1,
1321 description: "Builtin IDM Control allowing reads and writes to user radius secrets.",
1322 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_RADIUS_ADMINS]),
1323 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1324 match_class_filter!(EntryClass::Account),
1325 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
1326 ])),
1327 search_attrs: vec![Attribute::RadiusSecret],
1328 modify_present_attrs: vec![Attribute::RadiusSecret],
1329 modify_removed_attrs: vec![Attribute::RadiusSecret],
1330 ..Default::default()
1331 };
1332}
1333
1334lazy_static! {
1335 pub static ref IDM_ACP_MAIL_SERVERS_DL8: BuiltinAcp = BuiltinAcp {
1336 classes: vec![
1337 EntryClass::Object,
1338 EntryClass::AccessControlProfile,
1339 EntryClass::AccessControlSearch,
1340 ],
1341 name: "idm_acp_mail_servers",
1342 uuid: UUID_IDM_ACP_MAIL_SERVERS,
1343 description:
1344 "Builtin IDM Control for MAIL servers to read email addresses and other needed attributes.",
1345 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_MAIL_SERVERS]),
1346 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1347 ProtoFilter::Or(vec![
1348 match_class_filter!(EntryClass::Account),
1349 match_class_filter!(EntryClass::Group),
1350 ]),
1351 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
1352 ])),
1353 search_attrs: vec![
1354 Attribute::Class,
1355 Attribute::Name,
1356 Attribute::Spn,
1357 Attribute::Uuid,
1358 Attribute::DisplayName,
1359 Attribute::Mail,
1360 Attribute::Member,
1361 Attribute::DynMember,
1362 Attribute::MemberOf,
1363 Attribute::GidNumber,
1364 ],
1365 ..Default::default()
1366 };
1367}
1368
1369lazy_static! {
1370 pub static ref IDM_ACP_PEOPLE_SELF_WRITE_MAIL_V1: BuiltinAcp = BuiltinAcp {
1371 classes: vec![
1372 EntryClass::Object,
1373 EntryClass::AccessControlProfile,
1374 EntryClass::AccessControlModify,
1375 ],
1376 name: "idm_acp_people_self_write_mail",
1377 uuid: UUID_IDM_ACP_PEOPLE_SELF_WRITE_MAIL,
1378 description: "Builtin IDM Control for self write of mail for people accounts.",
1379 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_PEOPLE_SELF_MAIL_WRITE]),
1380 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1381 match_class_filter!(EntryClass::Person).clone(),
1382 match_class_filter!(EntryClass::Account).clone(),
1383 ProtoFilter::SelfUuid,
1384 ])),
1385 modify_removed_attrs: vec![Attribute::Mail],
1386 modify_present_attrs: vec![Attribute::Mail],
1387 ..Default::default()
1388 };
1389}
1390
1391lazy_static! {
1392 pub static ref IDM_ACP_SELF_READ_V1: BuiltinAcp = BuiltinAcp {
1393 name: "idm_acp_self_read",
1394 uuid: UUID_IDM_ACP_SELF_READ,
1395 description:
1396 "Builtin IDM Control for self read - required for whoami and many other functions",
1397 classes: vec![
1398 EntryClass::Object,
1399 EntryClass::AccessControlProfile,
1400 EntryClass::AccessControlSearch,
1401 ],
1402 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ALL_ACCOUNTS]),
1403 target: BuiltinAcpTarget::Filter(ProtoFilter::SelfUuid),
1404 search_attrs: vec![
1405 Attribute::Class,
1406 Attribute::Name,
1407 Attribute::Spn,
1408 Attribute::DisplayName,
1409 Attribute::LegalName,
1410 Attribute::Class,
1411 Attribute::MemberOf,
1412 Attribute::Mail,
1413 Attribute::RadiusSecret,
1414 Attribute::GidNumber,
1415 Attribute::LoginShell,
1416 Attribute::Uuid,
1417 Attribute::SyncParentUuid,
1418 Attribute::AccountExpire,
1419 Attribute::AccountValidFrom,
1420 Attribute::PrimaryCredential,
1421 Attribute::UserAuthTokenSession,
1422 Attribute::PassKeys,
1423 Attribute::AttestedPasskeys,
1424 ],
1425 ..Default::default()
1426 };
1427}
1428
1429lazy_static! {
1430 pub static ref IDM_ACP_SELF_READ_DL8: BuiltinAcp = BuiltinAcp {
1431 name: "idm_acp_self_read",
1432 uuid: UUID_IDM_ACP_SELF_READ,
1433 description:
1434 "Builtin IDM Control for self read - required for whoami and many other functions",
1435 classes: vec![
1436 EntryClass::Object,
1437 EntryClass::AccessControlProfile,
1438 EntryClass::AccessControlSearch,
1439 ],
1440 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ALL_ACCOUNTS]),
1441 target: BuiltinAcpTarget::Filter(ProtoFilter::SelfUuid),
1442 search_attrs: vec![
1443 Attribute::Class,
1444 Attribute::Name,
1445 Attribute::Spn,
1446 Attribute::DisplayName,
1447 Attribute::LegalName,
1448 Attribute::Class,
1449 Attribute::MemberOf,
1450 Attribute::Mail,
1451 Attribute::RadiusSecret,
1452 Attribute::GidNumber,
1453 Attribute::LoginShell,
1454 Attribute::Uuid,
1455 Attribute::SyncParentUuid,
1456 Attribute::AccountExpire,
1457 Attribute::AccountValidFrom,
1458 Attribute::PrimaryCredential,
1459 Attribute::UserAuthTokenSession,
1460 Attribute::PassKeys,
1461 Attribute::AttestedPasskeys,
1462 Attribute::ApplicationPassword,
1463 Attribute::SshPublicKey,
1464 Attribute::UnixPassword,
1465 ],
1466 ..Default::default()
1467 };
1468}
1469
1470lazy_static! {
1471 pub static ref IDM_ACP_SELF_WRITE_V1: BuiltinAcp = BuiltinAcp{
1472 name: "idm_acp_self_write",
1473 uuid: UUID_IDM_ACP_SELF_WRITE_V1,
1474 classes: vec![
1475 EntryClass::Object,
1476 EntryClass::AccessControlProfile,
1477 EntryClass::AccessControlModify,
1478 ],
1479 description: "Builtin IDM Control for self write - required for people to update their own identities and credentials in line with best practices.",
1480 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_ALL_PERSONS] ),
1481 target: BuiltinAcpTarget::Filter(ProtoFilter::SelfUuid),
1482 modify_removed_attrs: vec![
1483 Attribute::DisplayName,
1484 Attribute::LegalName,
1485 Attribute::RadiusSecret,
1486 Attribute::PrimaryCredential,
1487 Attribute::SshPublicKey,
1488 Attribute::UnixPassword,
1489 Attribute::PassKeys,
1490 Attribute::AttestedPasskeys,
1491 Attribute::UserAuthTokenSession,
1492 Attribute::ApplicationPassword,
1493 ],
1494 modify_present_attrs: vec![
1495 Attribute::DisplayName,
1496 Attribute::LegalName,
1497 Attribute::RadiusSecret,
1498 Attribute::PrimaryCredential,
1499 Attribute::SshPublicKey,
1500 Attribute::UnixPassword,
1501 Attribute::PassKeys,
1502 Attribute::AttestedPasskeys,
1503 Attribute::ApplicationPassword,
1504 ],
1505 ..Default::default()
1506 };
1507}
1508
1509lazy_static! {
1510 pub static ref IDM_ACP_SELF_WRITE_DL7: BuiltinAcp = BuiltinAcp{
1511 name: "idm_acp_self_write",
1512 uuid: UUID_IDM_ACP_SELF_WRITE_V1,
1513 classes: vec![
1514 EntryClass::Object,
1515 EntryClass::AccessControlProfile,
1516 EntryClass::AccessControlModify,
1517 ],
1518 description: "Builtin IDM Control for self write - required for people to update their own credentials in line with best practices.",
1519 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_ALL_PERSONS] ),
1520 target: BuiltinAcpTarget::Filter(ProtoFilter::SelfUuid),
1521 modify_removed_attrs: vec![
1522 Attribute::RadiusSecret,
1523 Attribute::PrimaryCredential,
1524 Attribute::SshPublicKey,
1525 Attribute::UnixPassword,
1526 Attribute::PassKeys,
1527 Attribute::AttestedPasskeys,
1528 Attribute::UserAuthTokenSession,
1529 ],
1530 modify_present_attrs: vec![
1531 Attribute::RadiusSecret,
1532 Attribute::PrimaryCredential,
1533 Attribute::SshPublicKey,
1534 Attribute::UnixPassword,
1535 Attribute::PassKeys,
1536 Attribute::AttestedPasskeys,
1537 ],
1538 ..Default::default()
1539 };
1540}
1541
1542lazy_static! {
1543 pub static ref IDM_ACP_SELF_WRITE_DL8: BuiltinAcp = BuiltinAcp{
1544 name: "idm_acp_self_write",
1545 uuid: UUID_IDM_ACP_SELF_WRITE_V1,
1546 classes: vec![
1547 EntryClass::Object,
1548 EntryClass::AccessControlProfile,
1549 EntryClass::AccessControlModify,
1550 ],
1551 description: "Builtin IDM Control for self write - required for people to update their own credentials in line with best practices.",
1552 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_ALL_PERSONS] ),
1553 target: BuiltinAcpTarget::Filter(ProtoFilter::SelfUuid),
1554 modify_removed_attrs: vec![
1555 Attribute::RadiusSecret,
1556 Attribute::PrimaryCredential,
1557 Attribute::SshPublicKey,
1558 Attribute::UnixPassword,
1559 Attribute::PassKeys,
1560 Attribute::AttestedPasskeys,
1561 Attribute::UserAuthTokenSession,
1562 Attribute::ApplicationPassword,
1563 ],
1564 modify_present_attrs: vec![
1565 Attribute::RadiusSecret,
1566 Attribute::PrimaryCredential,
1567 Attribute::SshPublicKey,
1568 Attribute::UnixPassword,
1569 Attribute::PassKeys,
1570 Attribute::AttestedPasskeys,
1571 Attribute::ApplicationPassword,
1572 ],
1573 ..Default::default()
1574 };
1575}
1576
1577lazy_static! {
1578 pub static ref IDM_ACP_SELF_NAME_WRITE_V1: BuiltinAcp = BuiltinAcp{
1579 name: "idm_acp_self_name_write",
1580 uuid: UUID_IDM_ACP_SELF_NAME_WRITE_V1,
1581 classes: vec![
1582 EntryClass::Object,
1583 EntryClass::AccessControlProfile,
1584 EntryClass::AccessControlModify,
1585 ],
1586 description: "Builtin IDM Control for self write of name - required for people to update their own identities in line with best practices.",
1587 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_ALL_PERSONS] ),
1588 target: BuiltinAcpTarget::Filter(ProtoFilter::SelfUuid),
1589 modify_removed_attrs: vec![
1590 Attribute::Name,
1591 ],
1592 modify_present_attrs: vec![
1593 Attribute::Name,
1594 ],
1595 ..Default::default()
1596 };
1597}
1598
1599lazy_static! {
1600 pub static ref IDM_ACP_SELF_NAME_WRITE_DL7: BuiltinAcp = BuiltinAcp{
1601 name: "idm_acp_self_name_write",
1602 uuid: UUID_IDM_ACP_SELF_NAME_WRITE_V1,
1603 classes: vec![
1604 EntryClass::Object,
1605 EntryClass::AccessControlProfile,
1606 EntryClass::AccessControlModify,
1607 ],
1608 description: "Builtin IDM Control for self write of name - required for people to update their own identities in line with best practices.",
1609 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_PEOPLE_SELF_NAME_WRITE] ),
1610 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1611 ProtoFilter::SelfUuid,
1612 match_class_filter!(EntryClass::Person).clone(),
1613 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1614 ])),
1615 modify_removed_attrs: vec![
1616 Attribute::Name,
1617 Attribute::DisplayName,
1618 Attribute::LegalName,
1619 ],
1620 modify_present_attrs: vec![
1621 Attribute::Name,
1622 Attribute::DisplayName,
1623 Attribute::LegalName,
1624 ],
1625 ..Default::default()
1626 };
1627}
1628
1629lazy_static! {
1630 pub static ref IDM_ACP_ACCOUNT_SELF_WRITE_V1: BuiltinAcp = BuiltinAcp {
1631 name: "idm_acp_account_self_write",
1632 uuid: UUID_IDM_ACP_ACCOUNT_SELF_WRITE_V1,
1633 description: "Builtin IDM Control for self write - required for accounts to update their own session state.",
1634 classes: vec![
1635 EntryClass::Object,
1636 EntryClass::AccessControlProfile,
1637 EntryClass::AccessControlModify
1638 ],
1639 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_ALL_ACCOUNTS] ),
1640 target: BuiltinAcpTarget::Filter(ProtoFilter::SelfUuid),
1641 modify_removed_attrs: vec![
1642 Attribute::UserAuthTokenSession
1643 ],
1644 ..Default::default()
1645 };
1646}
1647
1648lazy_static! {
1649 pub static ref IDM_ACP_ALL_ACCOUNTS_POSIX_READ_V1: BuiltinAcp = BuiltinAcp {
1650 classes: vec![
1651 EntryClass::Object,
1652 EntryClass::AccessControlProfile,
1653 EntryClass::AccessControlSearch,
1654 ],
1655 name: "idm_acp_all_accounts_posix_read",
1656 uuid: UUID_IDM_ACP_ALL_ACCOUNTS_POSIX_READ_V1,
1657 description:
1658 "Builtin IDM Control for reading minimal posix attrs - applies anonymous and all authenticated accounts.",
1659 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_ALL_ACCOUNTS] ),
1660 target: BuiltinAcpTarget::Filter( ProtoFilter::And(
1661 vec![
1662 ProtoFilter::Or(vec![
1663 match_class_filter!(EntryClass::Account),
1664 match_class_filter!(EntryClass::Group),
1665 ]),
1666 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1667 ]
1668 )),
1669 search_attrs: vec![
1670 Attribute::Class,
1671 Attribute::Name,
1672 Attribute::Spn,
1673 Attribute::DisplayName,
1674 Attribute::Class,
1675 Attribute::MemberOf,
1676 Attribute::Member,
1677 Attribute::DynMember,
1678 Attribute::Uuid,
1679 Attribute::GidNumber,
1680 Attribute::LoginShell,
1681 Attribute::SshPublicKey,
1682 ],
1683 ..Default::default()
1684 };
1685}
1686
1687lazy_static! {
1688 pub static ref IDM_ACP_ACCOUNT_MAIL_READ_DL6: BuiltinAcp = BuiltinAcp {
1689 classes: vec![
1690 EntryClass::Object,
1691 EntryClass::AccessControlProfile,
1692 EntryClass::AccessControlSearch
1693 ],
1694 name: "idm_acp_account_mail_read",
1695 uuid: UUID_IDM_ACP_ACCOUNT_MAIL_READ_V1,
1696 description: "Builtin IDM Control for reading account and group mail attributes.",
1697 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ACCOUNT_MAIL_READ]),
1698 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1699 ProtoFilter::Or(vec![
1700 match_class_filter!(EntryClass::Account),
1701 match_class_filter!(EntryClass::Group),
1702 ]),
1703 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1704 ])),
1705 search_attrs: vec![Attribute::Mail],
1706 ..Default::default()
1707 };
1708}
1709
1710lazy_static! {
1711 pub static ref IDM_ACP_SYSTEM_CONFIG_ACCOUNT_POLICY_MANAGE_V1: BuiltinAcp = BuiltinAcp {
1712 classes: vec![
1713 EntryClass::Object,
1714 EntryClass::AccessControlProfile,
1715 EntryClass::AccessControlModify,
1716 EntryClass::AccessControlSearch
1717 ],
1718 name: "idm_acp_system_config_account_policy_manage",
1719 uuid: UUID_IDM_ACP_SYSTEM_CONFIG_ACCOUNT_POLICY_MANAGE_V1,
1720 description: "Builtin IDM Control for granting system configuration of account policy",
1721 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ACCOUNT_POLICY_ADMINS]),
1722 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1723 ProtoFilter::Eq(
1724 Attribute::Uuid.to_string(),
1725 STR_UUID_SYSTEM_CONFIG.to_string()
1726 ),
1727 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
1728 ])),
1729 search_attrs: vec![
1730 Attribute::Class,
1731 Attribute::Name,
1732 Attribute::Uuid,
1733 Attribute::Description,
1734 Attribute::BadlistPassword,
1735 Attribute::DeniedName,
1736 Attribute::AuthSessionExpiry,
1737 Attribute::PrivilegeExpiry,
1738 Attribute::Version,
1739 ],
1740 modify_removed_attrs: vec![
1741 Attribute::BadlistPassword,
1742 Attribute::DeniedName,
1743 Attribute::AuthSessionExpiry,
1744 Attribute::PrivilegeExpiry,
1745 ],
1746 modify_present_attrs: vec![
1747 Attribute::BadlistPassword,
1748 Attribute::DeniedName,
1749 Attribute::AuthSessionExpiry,
1750 Attribute::PrivilegeExpiry,
1751 ],
1752 ..Default::default()
1753 };
1754}
1755
1756lazy_static! {
1757 pub static ref IDM_ACP_HP_GROUP_UNIX_MANAGE_V1: BuiltinAcp = BuiltinAcp{
1758 classes: vec![
1759 EntryClass::Object,
1760 EntryClass::AccessControlProfile,
1761 EntryClass::AccessControlModify,
1762 EntryClass::AccessControlSearch
1763 ],
1764 name: "idm_acp_hp_group_unix_manage",
1765 uuid: UUID_IDM_ACP_HP_GROUP_UNIX_MANAGE_V1,
1766 description: "Builtin IDM Control for managing and extending high privilege groups with unix attributes",
1767 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_UNIX_ADMINS] ),
1768 target: BuiltinAcpTarget::Filter( ProtoFilter::And(vec![
1770 match_class_filter!(EntryClass::Group),
1771 FILTER_HP.clone(),
1772 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1773 ])),
1774 search_attrs: vec![
1775 Attribute::DynMember,
1776 Attribute::Class,
1777 Attribute::Name,
1778 Attribute::Uuid,
1779 Attribute::Spn,
1780 Attribute::Description,
1781 Attribute::Member,
1782 Attribute::GidNumber,
1783 ],
1784 modify_removed_attrs: vec![
1785 Attribute::GidNumber,
1786 ],
1787 modify_present_attrs: vec![
1788 Attribute::Class,
1789 Attribute::GidNumber,
1790 ],
1791 modify_classes: vec![
1792 EntryClass::PosixGroup,
1793 ],
1794 ..Default::default()
1795 };
1796}
1797
1798lazy_static! {
1799 pub static ref IDM_ACP_GROUP_MANAGE_DL6: BuiltinAcp = BuiltinAcp{
1800 classes: vec![
1801 EntryClass::Object,
1802 EntryClass::AccessControlProfile,
1803 EntryClass::AccessControlCreate,
1804 EntryClass::AccessControlDelete,
1805 EntryClass::AccessControlModify,
1806 EntryClass::AccessControlSearch
1807 ],
1808 name: "idm_acp_group_manage",
1809 uuid: UUID_IDM_ACP_GROUP_MANAGE_V1,
1810 description: "Builtin IDM Control for creating and deleting groups in the directory",
1811 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_GROUP_ADMINS] ),
1812 target: BuiltinAcpTarget::Filter( ProtoFilter::And(vec![
1814 match_class_filter!(EntryClass::Group),
1815 FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE.clone(),
1816 ])),
1817 search_attrs: vec![
1818 Attribute::Class,
1819 Attribute::Name,
1820 Attribute::Uuid,
1821 Attribute::Spn,
1822 Attribute::Uuid,
1823 Attribute::Description,
1824 Attribute::Mail,
1825 Attribute::Member,
1826 Attribute::DynMember,
1827 Attribute::EntryManagedBy,
1828 ],
1829 create_attrs: vec![
1830 Attribute::Class,
1831 Attribute::Name,
1832 Attribute::Uuid,
1833 Attribute::Description,
1834 Attribute::Mail,
1835 Attribute::Member,
1836 Attribute::EntryManagedBy,
1837 ],
1838 create_classes: vec![
1839 EntryClass::Object,
1840 EntryClass::Group,
1841 ],
1842 modify_present_attrs: vec![
1843 Attribute::Name,
1844 Attribute::Description,
1845 Attribute::Mail,
1846 Attribute::Member,
1847 ],
1848 modify_removed_attrs: vec![
1849 Attribute::Name,
1850 Attribute::Description,
1851 Attribute::Mail,
1852 Attribute::Member,
1853 ],
1854 ..Default::default()
1855 };
1856}
1857
1858lazy_static! {
1859 pub static ref IDM_ACP_GROUP_MANAGE_DL9: BuiltinAcp = BuiltinAcp{
1860 classes: vec![
1861 EntryClass::Object,
1862 EntryClass::AccessControlProfile,
1863 EntryClass::AccessControlCreate,
1864 EntryClass::AccessControlDelete,
1865 EntryClass::AccessControlModify,
1866 EntryClass::AccessControlSearch
1867 ],
1868 name: "idm_acp_group_manage",
1869 uuid: UUID_IDM_ACP_GROUP_MANAGE_V1,
1870 description: "Builtin IDM Control for creating and deleting groups in the directory",
1871 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_GROUP_ADMINS] ),
1872 target: BuiltinAcpTarget::Filter( ProtoFilter::And(vec![
1874 match_class_filter!(EntryClass::Group),
1875 FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE.clone(),
1876 ])),
1877 search_attrs: vec![
1878 Attribute::Class,
1879 Attribute::Name,
1880 Attribute::Uuid,
1881 Attribute::Spn,
1882 Attribute::Uuid,
1883 Attribute::Description,
1884 Attribute::Mail,
1885 Attribute::Member,
1886 Attribute::DynMember,
1887 Attribute::EntryManagedBy,
1888 ],
1889 create_attrs: vec![
1890 Attribute::Class,
1891 Attribute::Name,
1892 Attribute::Uuid,
1893 Attribute::Description,
1894 Attribute::Mail,
1895 Attribute::Member,
1896 Attribute::EntryManagedBy,
1897 ],
1898 create_classes: vec![
1899 EntryClass::Object,
1900 EntryClass::Group,
1901 ],
1902 modify_present_attrs: vec![
1903 Attribute::Name,
1904 Attribute::Description,
1905 Attribute::Mail,
1906 Attribute::Member,
1907 Attribute::EntryManagedBy,
1908 ],
1909 modify_removed_attrs: vec![
1910 Attribute::Name,
1911 Attribute::Description,
1912 Attribute::Mail,
1913 Attribute::Member,
1914 Attribute::EntryManagedBy,
1915 ],
1916 ..Default::default()
1917 };
1918}
1919
1920lazy_static! {
1921 pub static ref IDM_ACP_GROUP_UNIX_MANAGE_V1: BuiltinAcp = BuiltinAcp {
1922 classes: vec![
1923 EntryClass::Object,
1924 EntryClass::AccessControlProfile,
1925 EntryClass::AccessControlModify,
1926 EntryClass::AccessControlSearch
1927 ],
1928 name: "idm_acp_group_unix_manage",
1929 uuid: UUID_IDM_ACP_GROUP_UNIX_MANAGE_V1,
1930 description: "Builtin IDM Control for managing unix groups",
1931 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_UNIX_ADMINS]),
1932 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1933 match_class_filter!(EntryClass::Group),
1934 FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE.clone(),
1935 ])),
1936 search_attrs: vec![
1937 Attribute::DynMember,
1938 Attribute::Class,
1939 Attribute::Name,
1940 Attribute::Uuid,
1941 Attribute::Spn,
1942 Attribute::Description,
1943 Attribute::Member,
1944 Attribute::GidNumber,
1945 ],
1946 modify_removed_attrs: vec![Attribute::GidNumber,],
1947 modify_present_attrs: vec![Attribute::Class, Attribute::GidNumber,],
1948 modify_classes: vec![EntryClass::PosixGroup,],
1949 ..Default::default()
1950 };
1951}
1952
1953lazy_static! {
1954 pub static ref IDM_ACP_ACCOUNT_UNIX_EXTEND_V1: BuiltinAcp = BuiltinAcp {
1955 classes: vec![
1956 EntryClass::Object,
1957 EntryClass::AccessControlProfile,
1958 EntryClass::AccessControlModify,
1959 EntryClass::AccessControlSearch
1960 ],
1961 name: "idm_acp_account_unix_extend",
1962 uuid: UUID_IDM_ACP_ACCOUNT_UNIX_EXTEND_V1,
1963 description: "Builtin IDM Control for managing and extending unix accounts",
1964 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_UNIX_ADMINS]),
1965 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
1966 match_class_filter!(EntryClass::Account),
1967 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
1968 ])),
1969 search_attrs: vec![
1970 Attribute::Class,
1971 Attribute::Name,
1972 Attribute::Uuid,
1973 Attribute::Spn,
1974 Attribute::Description,
1975 Attribute::GidNumber,
1976 Attribute::LoginShell,
1977 Attribute::UnixPassword,
1978 Attribute::SshPublicKey,
1979 ],
1980 modify_removed_attrs: vec![
1981 Attribute::GidNumber,
1982 Attribute::LoginShell,
1983 Attribute::UnixPassword,
1984 Attribute::SshPublicKey,
1985 ],
1986 modify_present_attrs: vec![
1987 Attribute::Class,
1988 Attribute::GidNumber,
1989 Attribute::LoginShell,
1990 Attribute::UnixPassword,
1991 Attribute::SshPublicKey,
1992 ],
1993 modify_classes: vec![EntryClass::PosixAccount,],
1994 ..Default::default()
1995 };
1996}
1997
1998lazy_static! {
1999 pub static ref IDM_ACP_PEOPLE_PII_READ_V1: BuiltinAcp = BuiltinAcp {
2000 classes: vec![
2001 EntryClass::Object,
2002 EntryClass::AccessControlProfile,
2003 EntryClass::AccessControlSearch,
2004 ],
2005 name: "idm_acp_people_pii_read",
2006 uuid: UUID_IDM_ACP_PEOPLE_PII_READ_V1,
2007 description: "Builtin IDM Control for reading personal and sensitive data.",
2008 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_PEOPLE_ADMINS, UUID_IDM_PEOPLE_PII_READ]),
2009 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
2010 match_class_filter!(EntryClass::Person).clone(),
2011 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
2012 ])),
2013 search_attrs: vec![
2014 Attribute::Class,
2015 Attribute::Name,
2016 Attribute::Uuid,
2017 Attribute::Spn,
2018 Attribute::DisplayName,
2019 Attribute::LegalName,
2020 Attribute::Mail,
2021 ],
2022 ..Default::default()
2023 };
2024}
2025
2026lazy_static! {
2027 pub static ref IDM_ACP_PEOPLE_PII_MANAGE_V1: BuiltinAcp = BuiltinAcp {
2028 classes: vec![
2029 EntryClass::Object,
2030 EntryClass::AccessControlProfile,
2031 EntryClass::AccessControlModify
2032 ],
2033 name: "idm_acp_people_pii_manage",
2034 uuid: UUID_IDM_ACP_PEOPLE_PII_MANAGE_V1,
2035 description: "Builtin IDM Control for modifying peoples personal and sensitive data",
2036 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_PEOPLE_ADMINS]),
2037 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
2038 match_class_filter!(EntryClass::Person),
2039 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
2040 ])),
2041 modify_removed_attrs: vec![
2042 Attribute::Name,
2043 Attribute::DisplayName,
2044 Attribute::LegalName,
2045 Attribute::Mail,
2046 ],
2047 modify_present_attrs: vec![
2048 Attribute::Name,
2049 Attribute::DisplayName,
2050 Attribute::LegalName,
2051 Attribute::Mail,
2052 ],
2053 ..Default::default()
2054 };
2055}
2056
2057lazy_static! {
2058 pub static ref IDM_ACP_PEOPLE_CREATE_DL6: BuiltinAcp = BuiltinAcp {
2059 classes: vec![
2060 EntryClass::Object,
2061 EntryClass::AccessControlProfile,
2062 EntryClass::AccessControlCreate,
2063 ],
2064 name: "idm_acp_people_create",
2065 uuid: UUID_IDM_ACP_PEOPLE_CREATE_V1,
2066 description: "Builtin IDM Control for creating new persons.",
2067 receiver: BuiltinAcpReceiver::Group(vec![
2068 UUID_IDM_PEOPLE_ADMINS,
2069 UUID_IDM_PEOPLE_ON_BOARDING
2070 ]),
2071 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
2072 match_class_filter!(EntryClass::Person).clone(),
2073 match_class_filter!(EntryClass::Account).clone(),
2074 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
2075 ])),
2076 create_attrs: vec![
2077 Attribute::Class,
2078 Attribute::Uuid,
2079 Attribute::Name,
2080 Attribute::DisplayName,
2081 Attribute::Mail,
2082 Attribute::AccountExpire,
2083 Attribute::AccountValidFrom,
2084 ],
2085 create_classes: vec![EntryClass::Object, EntryClass::Account, EntryClass::Person,],
2086 ..Default::default()
2087 };
2088}
2089
2090lazy_static! {
2091 pub static ref IDM_ACP_PEOPLE_MANAGE_V1: BuiltinAcp = BuiltinAcp {
2092 classes: vec![
2093 EntryClass::Object,
2094 EntryClass::AccessControlProfile,
2095 EntryClass::AccessControlModify,
2096 ],
2097 name: "idm_acp_people_manage",
2098 uuid: UUID_IDM_ACP_PEOPLE_MANAGE_V1,
2099 description: "Builtin IDM Control for management of peoples non sensitive attributes.",
2100 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_PEOPLE_ADMINS]),
2101 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
2102 match_class_filter!(EntryClass::Person),
2103 match_class_filter!(EntryClass::Account),
2104 FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE.clone(),
2105 ])),
2106 modify_removed_attrs: vec![Attribute::AccountExpire, Attribute::AccountValidFrom,],
2107 modify_present_attrs: vec![Attribute::AccountExpire, Attribute::AccountValidFrom,],
2108 ..Default::default()
2109 };
2110}
2111
2112lazy_static! {
2114 pub static ref IDM_ACP_PEOPLE_READ_V1: BuiltinAcp = BuiltinAcp {
2115 classes: vec![
2116 EntryClass::Object,
2117 EntryClass::AccessControlProfile,
2118 EntryClass::AccessControlSearch,
2119 ],
2120 name: "idm_acp_people_read",
2121 uuid: UUID_IDM_ACP_PEOPLE_READ_V1,
2122 description: "Builtin IDM Control for reading non-sensitive data.",
2123 receiver: BuiltinAcpReceiver::Group(vec![
2124 UUID_IDM_PEOPLE_ADMINS,
2125 UUID_IDM_PEOPLE_PII_READ,
2126 UUID_IDM_ACCOUNT_MAIL_READ,
2127 UUID_IDM_SERVICE_DESK
2128 ]),
2129 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
2130 match_class_filter!(EntryClass::Person).clone(),
2131 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
2132 ])),
2133 search_attrs: vec![
2134 Attribute::Class,
2135 Attribute::Name,
2136 Attribute::Spn,
2137 Attribute::Uuid,
2138 Attribute::DisplayName,
2139 Attribute::MemberOf,
2140 Attribute::Uuid,
2141 Attribute::AccountExpire,
2142 Attribute::AccountValidFrom,
2143 ],
2144 ..Default::default()
2145 };
2146}
2147
2148lazy_static! {
2150 pub static ref IDM_ACP_PEOPLE_DELETE_V1: BuiltinAcp = BuiltinAcp {
2151 classes: vec![
2152 EntryClass::Object,
2153 EntryClass::AccessControlProfile,
2154 EntryClass::AccessControlDelete,
2155 ],
2156 name: "idm_acp_people_delete",
2157 uuid: UUID_IDM_ACP_PEOPLE_DELETE_V1,
2158 description: "Builtin IDM Control for deleting persons.",
2159 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_PEOPLE_ADMINS,]),
2160 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
2161 match_class_filter!(EntryClass::Person).clone(),
2162 match_class_filter!(EntryClass::Account).clone(),
2163 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
2164 ])),
2165 ..Default::default()
2166 };
2167}
2168
2169lazy_static! {
2171 pub static ref IDM_ACP_PEOPLE_CREDENTIAL_RESET_V1: BuiltinAcp = BuiltinAcp {
2172 classes: vec![
2173 EntryClass::Object,
2174 EntryClass::AccessControlProfile,
2175 EntryClass::AccessControlModify,
2176 EntryClass::AccessControlSearch
2177 ],
2178 name: "idm_acp_people_credential_reset",
2179 uuid: UUID_IDM_ACP_PEOPLE_CREDENTIAL_RESET_V1,
2180 description: "Builtin IDM Control for resetting peoples credentials ",
2181 receiver: BuiltinAcpReceiver::Group(vec![
2182 UUID_IDM_PEOPLE_ADMINS,
2183 UUID_IDM_SERVICE_DESK,
2184 UUID_IDM_PEOPLE_ON_BOARDING,
2185 ]),
2186 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
2187 match_class_filter!(EntryClass::Person),
2188 match_class_filter!(EntryClass::Account),
2189 FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE.clone(),
2190 ])),
2191 search_attrs: vec![
2192 Attribute::Class,
2193 Attribute::Uuid,
2194 Attribute::Name,
2195 Attribute::Spn,
2196 Attribute::PrimaryCredential,
2197 Attribute::AccountExpire,
2198 Attribute::AccountValidFrom,
2199 Attribute::PassKeys,
2200 Attribute::AttestedPasskeys,
2201 ],
2202 modify_removed_attrs: vec![
2203 Attribute::PrimaryCredential,
2204 Attribute::PassKeys,
2205 Attribute::AttestedPasskeys,
2206 ],
2207 modify_present_attrs: vec![
2208 Attribute::PrimaryCredential,
2209 Attribute::PassKeys,
2210 Attribute::AttestedPasskeys,
2211 ],
2212 ..Default::default()
2213 };
2214}
2215
2216lazy_static! {
2218 pub static ref IDM_ACP_HP_PEOPLE_CREDENTIAL_RESET_V1: BuiltinAcp = BuiltinAcp {
2219 classes: vec![
2220 EntryClass::Object,
2221 EntryClass::AccessControlProfile,
2222 EntryClass::AccessControlModify,
2223 EntryClass::AccessControlSearch
2224 ],
2225 name: "idm_acp_hp_people_credential_reset",
2226 uuid: UUID_IDM_ACP_HP_PEOPLE_CREDENTIAL_RESET_V1,
2227 description: "Builtin IDM Control for resetting high privilege peoples credentials ",
2228 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_PEOPLE_ADMINS,]),
2229 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
2230 match_class_filter!(EntryClass::Person),
2231 match_class_filter!(EntryClass::Account),
2232 FILTER_HP.clone(),
2233 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
2234 ])),
2235 search_attrs: vec![
2236 Attribute::Class,
2237 Attribute::Uuid,
2238 Attribute::Name,
2239 Attribute::Spn,
2240 Attribute::PrimaryCredential,
2241 Attribute::AccountExpire,
2242 Attribute::AccountValidFrom,
2243 Attribute::PassKeys,
2244 Attribute::AttestedPasskeys,
2245 ],
2246 modify_removed_attrs: vec![
2247 Attribute::PrimaryCredential,
2248 Attribute::AccountExpire,
2249 Attribute::AccountValidFrom,
2250 Attribute::PassKeys,
2251 Attribute::AttestedPasskeys,
2252 ],
2253 modify_present_attrs: vec![
2254 Attribute::PrimaryCredential,
2255 Attribute::AccountExpire,
2256 Attribute::AccountValidFrom,
2257 Attribute::PassKeys,
2258 Attribute::AttestedPasskeys,
2259 ],
2260 ..Default::default()
2261 };
2262}
2263
2264lazy_static! {
2267 pub static ref IDM_ACP_SERVICE_ACCOUNT_CREATE_V1: BuiltinAcp = BuiltinAcp {
2268 classes: vec![
2269 EntryClass::Object,
2270 EntryClass::AccessControlProfile,
2271 EntryClass::AccessControlCreate,
2272 ],
2273 name: "idm_acp_service_account_create",
2274 uuid: UUID_IDM_ACP_SERVICE_ACCOUNT_CREATE_V1,
2275 description: "Builtin IDM Control for creating new service accounts.",
2276 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_SERVICE_ACCOUNT_ADMINS]),
2277 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
2278 match_class_filter!(EntryClass::ServiceAccount).clone(),
2279 match_class_filter!(EntryClass::Account).clone(),
2280 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
2281 ])),
2282 create_attrs: vec![
2283 Attribute::Class,
2284 Attribute::Name,
2285 Attribute::DisplayName,
2286 Attribute::EntryManagedBy,
2287 Attribute::Description,
2288 Attribute::AccountExpire,
2289 Attribute::AccountValidFrom,
2290 ],
2291 create_classes: vec![
2292 EntryClass::Object,
2293 EntryClass::Account,
2294 EntryClass::ServiceAccount,
2295 ],
2296 ..Default::default()
2297 };
2298}
2299
2300lazy_static! {
2301 pub static ref IDM_ACP_SERVICE_ACCOUNT_MANAGE_V1: BuiltinAcp = BuiltinAcp {
2302 classes: vec![
2303 EntryClass::Object,
2304 EntryClass::AccessControlProfile,
2305 EntryClass::AccessControlModify
2306 ],
2307 name: "idm_acp_service_account_manage",
2308 uuid: UUID_IDM_ACP_SERVICE_ACCOUNT_MANAGE_V1,
2309 description: "Builtin IDM Control for modifying service account data",
2310 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_SERVICE_ACCOUNT_ADMINS]),
2311 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
2312 match_class_filter!(EntryClass::ServiceAccount).clone(),
2313 match_class_filter!(EntryClass::Account).clone(),
2314 FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE.clone(),
2315 ])),
2316 modify_removed_attrs: vec![
2317 Attribute::Name,
2318 Attribute::DisplayName,
2319 Attribute::Mail,
2320 Attribute::SshPublicKey,
2321 Attribute::UnixPassword,
2322 Attribute::PrimaryCredential,
2323 Attribute::ApiTokenSession,
2324 Attribute::UserAuthTokenSession,
2325 ],
2326 modify_present_attrs: vec![Attribute::Name, Attribute::DisplayName, Attribute::Mail,],
2327 ..Default::default()
2328 };
2329}
2330
2331lazy_static! {
2332 pub static ref IDM_ACP_SERVICE_ACCOUNT_DELETE_V1: BuiltinAcp = BuiltinAcp {
2333 classes: vec![
2334 EntryClass::Object,
2335 EntryClass::AccessControlProfile,
2336 EntryClass::AccessControlDelete,
2337 ],
2338 name: "idm_acp_service_account_delete",
2339 uuid: UUID_IDM_ACP_SERVICE_ACCOUNT_DELETE_V1,
2340 description: "Builtin IDM Control for deleting service accounts.",
2341 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_SERVICE_ACCOUNT_ADMINS]),
2342 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
2343 match_class_filter!(EntryClass::ServiceAccount).clone(),
2344 match_class_filter!(EntryClass::Account).clone(),
2345 FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE.clone(),
2346 ])),
2347 ..Default::default()
2348 };
2349}
2350
2351lazy_static! {
2355 pub static ref IDM_ACP_SERVICE_ACCOUNT_ENTRY_MANAGER_V1: BuiltinAcp = BuiltinAcp{
2356 classes: vec![
2357 EntryClass::Object,
2358 EntryClass::AccessControlProfile,
2359 EntryClass::AccessControlModify,
2360 EntryClass::AccessControlSearch
2361 ],
2362 name: "idm_acp_service_account_entry_manager",
2363 uuid: UUID_IDM_ACP_SERVICE_ACCOUNT_ENTRY_MANAGER_V1,
2364 description: "Builtin IDM Control for allowing entry managers to modify service accounts",
2365 receiver: BuiltinAcpReceiver::EntryManager,
2366 target: BuiltinAcpTarget::Filter( ProtoFilter::And(vec![
2367 match_class_filter!(EntryClass::Account),
2368 match_class_filter!(EntryClass::ServiceAccount),
2369 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
2370 ])),
2371 search_attrs: vec![
2372 Attribute::Class,
2373 Attribute::Name,
2374 Attribute::Spn,
2375 Attribute::Uuid,
2376 Attribute::EntryManagedBy,
2377 Attribute::DisplayName,
2378 Attribute::SshPublicKey,
2379 Attribute::GidNumber,
2380 Attribute::LoginShell,
2381 Attribute::UnixPassword,
2382 Attribute::PassKeys,
2383 Attribute::PrimaryCredential,
2384 Attribute::AccountExpire,
2385 Attribute::AccountValidFrom,
2386 Attribute::ApiTokenSession,
2387 Attribute::UserAuthTokenSession,
2388 ],
2389 modify_removed_attrs: vec![
2390 Attribute::DisplayName,
2391 Attribute::SshPublicKey,
2392 Attribute::PrimaryCredential,
2393 Attribute::UnixPassword,
2394 Attribute::PassKeys,
2396 Attribute::AccountExpire,
2397 Attribute::AccountValidFrom,
2398 Attribute::ApiTokenSession,
2399 Attribute::UserAuthTokenSession,
2400 ],
2401 modify_present_attrs: vec![
2402 Attribute::DisplayName,
2403 Attribute::SshPublicKey,
2404 Attribute::PrimaryCredential,
2405 Attribute::AccountExpire,
2408 Attribute::AccountValidFrom,
2409 Attribute::ApiTokenSession,
2410 ],
2411 ..Default::default()
2412 };
2413}
2414
2415lazy_static! {
2417 pub static ref IDM_ACP_SERVICE_ACCOUNT_ENTRY_MANAGED_BY_MODIFY_V1: BuiltinAcp = BuiltinAcp {
2418 classes: vec![
2419 EntryClass::Object,
2420 EntryClass::AccessControlProfile,
2421 EntryClass::AccessControlModify,
2422 EntryClass::AccessControlSearch
2423 ],
2424 name: "idm_acp_service_account_entry_managed_by_modify",
2425 uuid: UUID_IDM_ACP_SERVICE_ACCOUNT_ENTRY_MANAGED_BY_MODIFY,
2426 description:
2427 "Builtin IDM Control for allowing entry_managed_by to be set on service account entries",
2428 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_SERVICE_ACCOUNT_ADMINS]),
2429 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
2430 match_class_filter!(EntryClass::ServiceAccount).clone(),
2431 match_class_filter!(EntryClass::Account).clone(),
2432 FILTER_ANDNOT_HP_OR_RECYCLED_OR_TOMBSTONE.clone(),
2433 ])),
2434 search_attrs: vec![
2435 Attribute::Class,
2436 Attribute::Name,
2437 Attribute::Spn,
2438 Attribute::Uuid,
2439 Attribute::EntryManagedBy,
2440 ],
2441 modify_removed_attrs: vec![Attribute::EntryManagedBy],
2442 modify_present_attrs: vec![Attribute::EntryManagedBy],
2443 ..Default::default()
2444 };
2445}
2446
2447lazy_static! {
2448 pub static ref IDM_ACP_HP_SERVICE_ACCOUNT_ENTRY_MANAGED_BY_MODIFY_V1: BuiltinAcp = BuiltinAcp {
2449 classes: vec![
2450 EntryClass::Object,
2451 EntryClass::AccessControlProfile,
2452 EntryClass::AccessControlModify,
2453 EntryClass::AccessControlSearch
2454 ],
2455 name: "idm_acp_hp_service_account_entry_managed_by",
2456 uuid: UUID_IDM_ACP_HP_SERVICE_ACCOUNT_ENTRY_MANAGED_BY_MODIFY,
2457 description: "Builtin IDM Control for allowing entry_managed_by to be set on high priv service account entries",
2458 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_ACCESS_CONTROL_ADMINS]),
2459 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
2460 match_class_filter!(EntryClass::ServiceAccount).clone(),
2461 match_class_filter!(EntryClass::Account).clone(),
2462 FILTER_HP.clone(),
2463 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone(),
2464 ])),
2465 search_attrs: vec![
2466 Attribute::Class,
2467 Attribute::Name,
2468 Attribute::Spn,
2469 Attribute::Uuid,
2470 Attribute::EntryManagedBy,
2471 ],
2472 modify_removed_attrs: vec![Attribute::EntryManagedBy],
2473 modify_present_attrs: vec![Attribute::EntryManagedBy],
2474 ..Default::default()
2475 };
2476}
2477
2478lazy_static! {
2479 pub static ref IDM_ACP_HP_CLIENT_CERTIFICATE_MANAGER_DL7: BuiltinAcp = BuiltinAcp {
2480 classes: vec![
2481 EntryClass::Object,
2482 EntryClass::AccessControlProfile,
2483 EntryClass::AccessControlCreate,
2484 EntryClass::AccessControlDelete,
2485 EntryClass::AccessControlModify,
2486 EntryClass::AccessControlSearch
2487 ],
2488 name: "idm_acp_hp_client_certificate_manager",
2489 uuid: UUID_IDM_ACP_HP_CLIENT_CERTIFICATE_MANAGER,
2490 description: "Builtin IDM Control for allowing client certificate management.",
2491 receiver: BuiltinAcpReceiver::Group(vec![UUID_IDM_CLIENT_CERTIFICATE_ADMINS]),
2492 target: BuiltinAcpTarget::Filter(ProtoFilter::And(vec![
2493 ProtoFilter::Eq(
2494 EntryClass::Class.to_string(),
2495 EntryClass::ClientCertificate.to_string()
2496 ),
2497 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
2498 ])),
2499 search_attrs: vec![
2500 Attribute::Class,
2501 Attribute::Uuid,
2502 Attribute::Certificate,
2503 Attribute::Refers,
2504 ],
2505 modify_removed_attrs: vec![Attribute::Certificate, Attribute::Refers,],
2506 modify_present_attrs: vec![Attribute::Certificate, Attribute::Refers,],
2507 create_attrs: vec![Attribute::Class, Attribute::Certificate, Attribute::Refers,],
2508 create_classes: vec![EntryClass::Object, EntryClass::ClientCertificate,],
2509 ..Default::default()
2510 };
2511}
2512
2513lazy_static! {
2514 pub static ref IDM_ACP_APPLICATION_MANAGE_DL8: BuiltinAcp = BuiltinAcp{
2515 classes: vec![
2516 EntryClass::Object,
2517 EntryClass::AccessControlProfile,
2518 EntryClass::AccessControlCreate,
2519 EntryClass::AccessControlDelete,
2520 EntryClass::AccessControlModify,
2521 EntryClass::AccessControlSearch
2522 ],
2523 name: "idm_acp_application_manage",
2524 uuid: UUID_IDM_ACP_APPLICATION_MANAGE,
2525 description: "Builtin IDM Control for creating and deleting applications in the directory",
2526 receiver: BuiltinAcpReceiver::Group ( vec![UUID_IDM_APPLICATION_ADMINS] ),
2527 target: BuiltinAcpTarget::Filter( ProtoFilter::And(vec![
2529 match_class_filter!(EntryClass::Application),
2530 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
2531 ])),
2532 search_attrs: vec![
2533 Attribute::Class,
2534 Attribute::Uuid,
2535 Attribute::Name,
2536 Attribute::Description,
2537 Attribute::DisplayName,
2538 Attribute::Mail,
2539 Attribute::UnixPassword,
2540 Attribute::ApiTokenSession,
2541 Attribute::UserAuthTokenSession,
2542 Attribute::LinkedGroup,
2543 Attribute::EntryManagedBy,
2544 ],
2545 create_attrs: vec![
2546 Attribute::Class,
2547 Attribute::Uuid,
2548 Attribute::Name,
2549 Attribute::Description,
2550 Attribute::DisplayName,
2551 Attribute::Mail,
2552 Attribute::LinkedGroup,
2553 Attribute::EntryManagedBy,
2554 ],
2555 create_classes: vec![
2556 EntryClass::Object,
2557 EntryClass::Account,
2558 EntryClass::ServiceAccount,
2559 EntryClass::Application,
2560 ],
2561 modify_present_attrs: vec![
2562 Attribute::Name,
2563 Attribute::Description,
2564 Attribute::DisplayName,
2565 Attribute::Mail,
2566 Attribute::UnixPassword,
2567 Attribute::ApiTokenSession,
2568 Attribute::LinkedGroup,
2569 Attribute::EntryManagedBy,
2570 ],
2571 modify_removed_attrs: vec![
2572 Attribute::Name,
2573 Attribute::Description,
2574 Attribute::DisplayName,
2575 Attribute::Mail,
2576 Attribute::UnixPassword,
2577 Attribute::ApiTokenSession,
2578 Attribute::UserAuthTokenSession,
2579 Attribute::LinkedGroup,
2580 Attribute::EntryManagedBy,
2581 ],
2582 ..Default::default()
2583 };
2584}
2585
2586lazy_static! {
2587 pub static ref IDM_ACP_APPLICATION_ENTRY_MANAGER_DL8: BuiltinAcp = BuiltinAcp {
2588 classes: vec![
2589 EntryClass::Object,
2590 EntryClass::AccessControlProfile,
2591 EntryClass::AccessControlModify,
2592 EntryClass::AccessControlSearch
2593 ],
2594 name: "idm_acp_application_entry_manager",
2595 uuid: UUID_IDM_ACP_APPLICATION_ENTRY_MANAGER,
2596 description: "Builtin IDM Control for allowing EntryManager to read and modify applications",
2597 receiver: BuiltinAcpReceiver::EntryManager,
2598 target: BuiltinAcpTarget::Filter( ProtoFilter::And(vec![
2600 match_class_filter!(EntryClass::Application),
2601 FILTER_ANDNOT_TOMBSTONE_OR_RECYCLED.clone()
2602 ])),
2603 search_attrs: vec![
2604 Attribute::Class,
2605 Attribute::Uuid,
2606 Attribute::Name,
2607 Attribute::DisplayName,
2608 Attribute::Mail,
2609 Attribute::UnixPassword,
2610 Attribute::ApiTokenSession,
2611 Attribute::UserAuthTokenSession,
2612 Attribute::Description,
2613 Attribute::LinkedGroup,
2614 Attribute::EntryManagedBy,
2615 ],
2616 modify_present_attrs: vec![
2617 Attribute::Name,
2618 Attribute::Description,
2619 Attribute::DisplayName,
2620 Attribute::Mail,
2621 Attribute::UnixPassword,
2622 Attribute::ApiTokenSession,
2623 Attribute::LinkedGroup,
2624 ],
2625 modify_removed_attrs: vec![
2626 Attribute::Name,
2627 Attribute::Description,
2628 Attribute::DisplayName,
2629 Attribute::Mail,
2630 Attribute::UnixPassword,
2631 Attribute::ApiTokenSession,
2632 Attribute::UserAuthTokenSession,
2633 Attribute::LinkedGroup,
2634 ],
2635 ..Default::default()
2636 };
2637}