fedora-infra / freeipa-fas

IPA schema extensions for FAS
GNU General Public License v3.0
12 stars 16 forks source link

Restrict group membership based on Agreements signed #114

Closed ryanlerch closed 4 years ago

ryanlerch commented 4 years ago

105 implements agreements, allowing users to "sign" agreements, and groups to be added to agreements.

However, being added to a group with an agreement needs to be restricted to only users that have signed that agreement.

For example, User has not signed Agreement A, so he cannot be added to Group A, which is a member of Agreement A. However, if User signs agreement A, they are subsequently allowed to be added to Group A.

If a group is attached to multiple agreements, a user must have signed all the agreements (eg, agreement A AND agreement B) before they are eligible to be added to that group.

Related: #46