- remove '{context}' - ucr templating for position - rename named_condition to condition - evaluate context position as is
univention-directory-manager-modules (17.3.0) 00d21fe5d94c6d160925d0a233edcfa4b78f8953 | chore(udm): update advisory
The following changes have been done: 1. in `guardianRoles` the UDM position context now needs to include the whole LDAP base (to be future compatible with e.g. `cn=internal`): Prior: `&udm:contexts:position=ou=bremen` After: `&udm:contexts:position=ou=bremen,dc=ucs,dc=org` 2. The context now isn't a format-string placeholder in the policy language anymore: Before: ``` access by role="udm:default-roles:organizational-unit-admin" context="udm:contexts:position" to objecttype="users/user" position.subtree="{context}" ``` Afterwards: ``` access by role="udm:default-roles:organizational-unit-admin" to objecttype="users/user" position.subtree="context=udm:contexts:position" ``` So we can treat it like a special DN with length 1 and the RDN attribute `context`. It makes it explicit, that the role is not bound to a context but only the current capability/privilege. That makes it easier in the future to create UDM objects out of the policy description language. univention-directory-manager-modules.yaml 00d21fe5d94c | chore(udm): update advisory univention-directory-manager-modules (17.3.1) 7ccfbc85eb8e | feat(udm): policy format changes univention-directory-manager-modules (17.3.0) e3ae5339e006 | docs(udm): fix typos in Guardian concept docs 59f528f88cec | style(udm-authorization): give privileges explicit names univention-authorization.yaml aa5b682f379e | chore(authorization): update advisory univention-authorization (1.1.0) ddec471d384a | feat(authorization): evaluate context position as is
OK: YAML OK: policy changes OK: documentation changes
<https://errata.software-univention.de/#/?erratum=5.2x224> <https://errata.software-univention.de/#/?erratum=5.2x233>
The placeholder "ldap_base" was changed to "ldap/base". univention-directory-manager-modules (17.3.1) 7ccfbc85eb8e | feat(udm): policy format changes e3ae5339e006 | docs(udm): fix typos in Guardian concept docs 59f528f88cec | style(udm-authorization): give privileges explicit names univention-authorization.yaml aa5b682f379e | chore(authorization): update advisory univention-authorization (1.1.0) ddec471d384a | feat(authorization): evaluate context position as is