diff options
| author | Simo Sorce <ssorce@redhat.com> | 2008-06-24 08:40:21 -0400 |
|---|---|---|
| committer | Simo Sorce <ssorce@redhat.com> | 2008-07-09 16:50:54 -0400 |
| commit | f86c8420b1e5f22ef4b73a34c7598b3ff4f9753b (patch) | |
| tree | 3be51a2bf8877efdb47aa32fd1274a88b7b4b73d | |
| parent | 3f85a011c60ead633a04a239cb7b7c8b82fd7017 (diff) | |
| download | freeipa-f86c8420b1e5f22ef4b73a34c7598b3ff4f9753b.tar.gz freeipa-f86c8420b1e5f22ef4b73a34c7598b3ff4f9753b.tar.xz freeipa-f86c8420b1e5f22ef4b73a34c7598b3ff4f9753b.zip | |
Admin must be able to add/delete too
| -rw-r--r-- | ipa-server/ipa-install/share/default-aci.ldif | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ipa-server/ipa-install/share/default-aci.ldif b/ipa-server/ipa-install/share/default-aci.ldif index 9cb5d831b..d2946fa81 100644 --- a/ipa-server/ipa-install/share/default-aci.ldif +++ b/ipa-server/ipa-install/share/default-aci.ldif @@ -6,7 +6,7 @@ add: aci aci: (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0; acl "Enable Anonymous access"; allow (read, search, compare) userdn = "ldap:///anyone";) aci: (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0; acl "Admin can manage any entry"; allow (all) userdn = "ldap:///uid=admin,cn=users,cn=accounts,$SUFFIX";) aci: (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword")(version 3.0; acl "Self can write own password"; allow (write) userdn="ldap:///self";) -aci: (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0; acl "Admins can write passwords"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,$SUFFIX";) +aci: (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,$SUFFIX";) aci: (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0; acl "Password change service can read/write passwords"; allow (read, write) userdn="ldap:///krbprincipalname=kadmin/changepw@$REALM,cn=$REALM,cn=kerberos,$SUFFIX";) aci: (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0; acl "KDC System Account can access passwords"; allow (all) userdn="ldap:///uid=kdc,cn=sysaccounts,cn=etc,$SUFFIX";) aci: (targetattr = "krbLastSuccessfulAuth || krbLastFailedAuth || krbLoginFailedCount")(version 3.0; acl "KDC System Account can update some fields"; allow (write) userdn="ldap:///uid=kdc,cn=sysaccounts,cn=etc,$SUFFIX";) |