[Pkg-puppet-devel] [SCM] Puppet packaging for Debian branch, experimental, updated. debian/2.6.8-1-844-g7ec39d5
Pieter van de Bruggen
pieter at puppetlabs.com
Tue May 10 08:19:42 UTC 2011
The following commit has been merged in the experimental branch:
commit 5076c3794dcbfd708d9169d720b8fc5a41998a14
Author: Pieter van de Bruggen <pieter at puppetlabs.com>
Date: Wed May 4 16:44:48 2011 -0700
(#7179) Modify default ACL for /node/<name>.
By default, it is useful to permit an individual node to query
information about itself, and there is no good reason to reject
this by default.
Paired-With: Nick Lewis
diff --git a/conf/auth.conf b/conf/auth.conf
index 431e4b2..cb202a9 100644
--- a/conf/auth.conf
+++ b/conf/auth.conf
@@ -53,6 +53,11 @@ path ~ ^/catalog/([^/]+)$
method find
allow $1
+# allow nodes to retrieve their own node definition
+path ~ ^/node/([^/]+)$
+method find
+allow $1
+
# allow all nodes to access the certificates services
path /certificate_revocation_list/ca
method find
diff --git a/lib/puppet/network/rest_authconfig.rb b/lib/puppet/network/rest_authconfig.rb
index cf76978..dfe8f85 100644
--- a/lib/puppet/network/rest_authconfig.rb
+++ b/lib/puppet/network/rest_authconfig.rb
@@ -8,6 +8,7 @@ module Puppet
DEFAULT_ACL = [
{ :acl => "~ ^\/catalog\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
+ { :acl => "~ ^\/node\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
# this one will allow all file access, and thus delegate
# to fileserver.conf
{ :acl => "/file" },
diff --git a/spec/unit/network/rest_authconfig_spec.rb b/spec/unit/network/rest_authconfig_spec.rb
index 499a14b..e140399 100755
--- a/spec/unit/network/rest_authconfig_spec.rb
+++ b/spec/unit/network/rest_authconfig_spec.rb
@@ -5,18 +5,7 @@ require 'puppet/network/rest_authconfig'
describe Puppet::Network::RestAuthConfig do
- DEFAULT_ACL = [
- { :acl => "~ ^\/catalog\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
- # this one will allow all file access, and thus delegate
- # to fileserver.conf
- { :acl => "/file" },
- { :acl => "/certificate_revocation_list/ca", :method => :find, :authenticated => true },
- { :acl => "/report", :method => :save, :authenticated => true },
- { :acl => "/certificate/ca", :method => :find, :authenticated => false },
- { :acl => "/certificate/", :method => :find, :authenticated => false },
- { :acl => "/certificate_request", :method => [:find, :save], :authenticated => false },
- { :acl => "/status", :method => [:find], :authenticated => true },
- ]
+ DEFAULT_ACL = Puppet::Network::RestAuthConfig::DEFAULT_ACL
before :each do
FileTest.stubs(:exists?).returns(true)
--
Puppet packaging for Debian
More information about the Pkg-puppet-devel
mailing list