summaryrefslogtreecommitdiffstats
path: root/ACI.txt
diff options
context:
space:
mode:
authorTomas Babej <tbabej@redhat.com>2014-07-31 13:13:29 +0200
committerMartin Kosek <mkosek@redhat.com>2014-09-30 10:42:06 +0200
commit377ab0c4a6f9f61f2a00844a2cea9233d908bbb1 (patch)
treec87127d73cfbb6681178b8374fd975b2f8b1fa27 /ACI.txt
parentb65b74890bdf6b6fde8379181dce66a1ef9db8d1 (diff)
downloadfreeipa-377ab0c4a6f9f61f2a00844a2cea9233d908bbb1.tar.gz
freeipa-377ab0c4a6f9f61f2a00844a2cea9233d908bbb1.tar.xz
freeipa-377ab0c4a6f9f61f2a00844a2cea9233d908bbb1.zip
idvies: Add managed permissions for idview and idoverride objects
Part of: https://fedorahosted.org/freeipa/ticket/3979 Reviewed-By: Petr Viktorin <pviktori@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Diffstat (limited to 'ACI.txt')
-rw-r--r--ACI.txt4
1 files changed, 4 insertions, 0 deletions
diff --git a/ACI.txt b/ACI.txt
index 80b555de8..eb88d31a8 100644
--- a/ACI.txt
+++ b/ACI.txt
@@ -118,8 +118,12 @@ dn: cn=hostgroups,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "businesscategory || cn || createtimestamp || description || entryusn || ipauniqueid || modifytimestamp || o || objectclass || ou || owner || seealso")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Read Hostgroups";allow (compare,read,search) userdn = "ldap:///all";)
dn: cn=hostgroups,cn=accounts,dc=ipa,dc=example
aci: (targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Remove Hostgroups";allow (delete) groupdn = "ldap:///cn=System: Remove Hostgroups,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=views,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "cn || createtimestamp || description || entryusn || gidnumber || homedirectory || ipaanchoruuid || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaOverrideAnchor)")(version 3.0;acl "permission:System: Read ID Overrides";allow (compare,read,search) userdn = "ldap:///all";)
dn: cn=ranges,cn=etc,dc=ipa,dc=example
aci: (targetattr = "cn || createtimestamp || entryusn || ipabaseid || ipabaserid || ipaidrangesize || ipanttrusteddomainsid || iparangetype || ipasecondarybaserid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidrange)")(version 3.0;acl "permission:System: Read ID Ranges";allow (compare,read,search) userdn = "ldap:///all";)
+dn: cn=views,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Read ID Views";allow (compare,read,search) userdn = "ldap:///all";)
dn: cn=IPA.EXAMPLE,cn=kerberos,dc=ipa,dc=example
aci: (targetattr = "createtimestamp || entryusn || krbdefaultencsalttypes || krbmaxrenewableage || krbmaxticketlife || krbsupportedencsalttypes || modifytimestamp || objectclass")(targetfilter = "(objectclass=krbticketpolicyaux)")(version 3.0;acl "permission:System: Read Default Kerberos Ticket Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Default Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=users,cn=accounts,dc=ipa,dc=example