From 46faed0b4bb2169fd2be79809b9a65b77a72ee14 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Jun 10 2014 11:55:56 +0000
Subject: Add missing attributes to User managed permissions


- Add nsAccountLock to the Unlock user accounts permission
- Add member to Read User Membership
- Add userClass and preferredLanguage to Modify Users

https://fedorahosted.org/freeipa/ticket/3697

Reviewed-By: Martin Kosek <mkosek@redhat.com>

---

diff --git a/ipalib/plugins/user.py b/ipalib/plugins/user.py
index 071cda5..4eb35bd 100644
--- a/ipalib/plugins/user.py
+++ b/ipalib/plugins/user.py
@@ -398,7 +398,8 @@ class user(LDAPObject):
                 'initials', 'l', 'labeleduri', 'loginshell', 'manager',
                 'mepmanagedentry', 'mobile', 'objectclass', 'ou', 'pager',
                 'postalcode', 'roomnumber', 'secretary', 'seealso', 'sn', 'st',
-                'street', 'telephonenumber', 'title'
+                'street', 'telephonenumber', 'title', 'userclass',
+                'preferredlanguage',
             },
             'replaces': [
                 '(targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou || mepmanagedentry || objectclass")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Users";allow (write) groupdn = "ldap:///cn=Modify Users,cn=permissions,cn=pbac,$SUFFIX";)',
@@ -420,7 +421,7 @@ class user(LDAPObject):
             'ipapermbindruletype': 'permission',
             'ipapermright': {'write'},
             'ipapermdefaultattr': {
-                'krblastadminunlock', 'krbloginfailedcount'
+                'krblastadminunlock', 'krbloginfailedcount', 'nsaccountlock',
             },
             'replaces': [
                 '(targetattr = "krbLastAdminUnlock || krbLoginFailedCount")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Unlock user accounts";allow (write) groupdn = "ldap:///cn=Unlock user accounts,cn=permissions,cn=pbac,$SUFFIX";)',