mirror of
https://github.com/kanidm/kanidm.git
synced 2025-02-23 04:27:02 +01:00
07b9ca8939
When we added entry-managed-by, we allowed it to be set on group creation but not post-group-creation. The idea was to delegate ownership of the group. However, this has the obvious trap that an account group like idm_admins can't alter entry-managed-by post creation, needing the use of the admin account which has access control privs, or a delete and recreate of the entry. Since the idm admin could delete and recreate the group with a new entry manager, there is functionally no difference to allowing them to modify the entry-managed-by here of low priv groups. This changes the group manager access control by default to allow this. |
||
|---|---|---|
| .. | ||
| core | ||
| daemon | ||
| lib | ||
| lib-macros | ||
| testkit | ||
| testkit-macros | ||
| builder.sh | ||
| Dockerfile | ||