add more privileges, improve docs

[pve-access-control.git] / PVE / API2 / Domains.pm

diff --git a/PVE/API2/Domains.pm b/PVE/API2/Domains.pm
index c79e44e0f033a1cbc08a645efabe029677ef9812..27a1c895c92dbf3a75b8364e0b96fd4dcb7d4f32 100644 (file)
--- a/PVE/API2/Domains.pm
+++ b/PVE/API2/Domains.pm
@@ -7,9 +7,6 @@ use PVE::AccessControl;
 use PVE::JSONSchema qw(get_standard_option);
 
 use PVE::SafeSyslog;
-
-use Data::Dumper; # fixme: remove
-
 use PVE::RESTHandler;
 
 my $domainconfigfile = "domains.cfg";
@@ -21,7 +18,10 @@ __PACKAGE__->register_method ({
     path => '', 
     method => 'GET',
     description => "Authentication domain index.",
-    permissions => { user => 'world' },
+    permissions => { 
+       description => "Anyone can access that, because we need that list for the login box (before the user is authenticated).",
+       user => 'world', 
+    },
     parameters => {
        additionalProperties => 0,
        properties => {},
@@ -60,6 +60,9 @@ __PACKAGE__->register_method ({
     protected => 1,
     path => '', 
     method => 'POST',
+    permissions => { 
+       check => ['perm', '/access/realm', ['Realm.Allocate']],
+    },
     description => "Add an authentication server.",
     parameters => {
        additionalProperties => 0,
@@ -167,6 +170,9 @@ __PACKAGE__->register_method ({
     name => 'update', 
     path => '{realm}', 
     method => 'PUT',
+    permissions => { 
+       check => ['perm', '/access/realm', ['Realm.Allocate']],
+    },
     description => "Update authentication server settings.",
     protected => 1,
     parameters => {
@@ -269,6 +275,9 @@ __PACKAGE__->register_method ({
     path => '{realm}', 
     method => 'GET',
     description => "Get auth server configuration.",
+    permissions => { 
+       check => ['perm', '/access/realm', ['Realm.Allocate', 'Sys.Audit'], any => 1],
+    },
     parameters => {
        additionalProperties => 0,
        properties => {
@@ -294,6 +303,9 @@ __PACKAGE__->register_method ({
     name => 'delete', 
     path => '{realm}', 
     method => 'DELETE',
+    permissions => { 
+       check => ['perm', '/access/realm', ['Realm.Allocate']],
+    },
     description => "Delete an authentication server.",
     protected => 1,
     parameters => {