[Pkg-puppet-devel] [SCM] Puppet packaging for Debian branch, experimental, updated. debian/2.6.8-1-844-g7ec39d5

[Pieter van de Bruggen]

The following commit has been merged in the experimental branch:
commit 5076c3794dcbfd708d9169d720b8fc5a41998a14
Author: Pieter van de Bruggen <pieter at puppetlabs.com>
Date:   Wed May 4 16:44:48 2011 -0700

    (#7179) Modify default ACL for /node/<name>.
    
    By default, it is useful to permit an individual node to query
    information about itself, and there is no good reason to reject
    this by default.
    
    Paired-With: Nick Lewis

diff --git a/conf/auth.conf b/conf/auth.conf
index 431e4b2..cb202a9 100644
--- a/conf/auth.conf
+++ b/conf/auth.conf
@@ -53,6 +53,11 @@ path ~ ^/catalog/([^/]+)$
 method find
 allow $1
 
+# allow nodes to retrieve their own node definition
+path ~ ^/node/([^/]+)$
+method find
+allow $1
+
 # allow all nodes to access the certificates services
 path /certificate_revocation_list/ca
 method find
diff --git a/lib/puppet/network/rest_authconfig.rb b/lib/puppet/network/rest_authconfig.rb
index cf76978..dfe8f85 100644
--- a/lib/puppet/network/rest_authconfig.rb
+++ b/lib/puppet/network/rest_authconfig.rb
@@ -8,6 +8,7 @@ module Puppet
 
     DEFAULT_ACL = [
       { :acl => "~ ^\/catalog\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
+      { :acl => "~ ^\/node\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
       # this one will allow all file access, and thus delegate
       # to fileserver.conf
       { :acl => "/file" },
diff --git a/spec/unit/network/rest_authconfig_spec.rb b/spec/unit/network/rest_authconfig_spec.rb
index 499a14b..e140399 100755
--- a/spec/unit/network/rest_authconfig_spec.rb
+++ b/spec/unit/network/rest_authconfig_spec.rb
@@ -5,18 +5,7 @@ require 'puppet/network/rest_authconfig'
 
 describe Puppet::Network::RestAuthConfig do
 
-  DEFAULT_ACL = [
-    { :acl => "~ ^\/catalog\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
-    # this one will allow all file access, and thus delegate
-    # to fileserver.conf
-    { :acl => "/file" },
-    { :acl => "/certificate_revocation_list/ca", :method => :find, :authenticated => true },
-    { :acl => "/report", :method => :save, :authenticated => true },
-    { :acl => "/certificate/ca", :method => :find, :authenticated => false },
-    { :acl => "/certificate/", :method => :find, :authenticated => false },
-    { :acl => "/certificate_request", :method => [:find, :save], :authenticated => false },
-    { :acl => "/status", :method => [:find], :authenticated => true },
-  ]
+  DEFAULT_ACL = Puppet::Network::RestAuthConfig::DEFAULT_ACL
 
   before :each do
     FileTest.stubs(:exists?).returns(true)

-- 
Puppet packaging for Debian