diff options
| author | Petr Viktorin <pviktori@redhat.com> | 2014-06-04 13:54:54 +0200 |
|---|---|---|
| committer | Petr Viktorin <pviktori@redhat.com> | 2014-06-23 12:44:33 +0200 |
| commit | 14e2eb9171c2cebff8efefac824edbe7dce1734c (patch) | |
| tree | ee2053728978e9117e8352ec60f0193130ca95f5 /ACI.txt | |
| parent | 8a5110305fafcb6d8770ef78cdff164b8ab1bc0c (diff) | |
| download | freeipa-14e2eb9171c2cebff8efefac824edbe7dce1734c.tar.gz freeipa-14e2eb9171c2cebff8efefac824edbe7dce1734c.tar.xz freeipa-14e2eb9171c2cebff8efefac824edbe7dce1734c.zip | |
host permissions: Allow writing attributes needed for automatic enrollment
- userclass
added to existing Modify hosts permission
- usercertificate, userpassword
added to a new permissions
https://fedorahosted.org/freeipa/ticket/4252
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Diffstat (limited to 'ACI.txt')
| -rw-r--r-- | ACI.txt | 6 |
1 files changed, 5 insertions, 1 deletions
@@ -44,12 +44,16 @@ dn: cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=ipa,dc=e aci: (targetattr = "krbprincipalname")(targetfilter = "(&(!(krbprincipalname=*))(objectclass=ipahost))")(version 3.0;acl "permission:System: Add krbPrincipalName to a Host";allow (write) groupdn = "ldap:///cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=ipa,dc=example aci: (targetattr = "enrolledby || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Enroll a Host";allow (write) groupdn = "ldap:///cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=ipa,dc=example";) +dn: cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=ipa,dc=example +aci: (targetattr = "usercertificate")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Certificates";allow (write) groupdn = "ldap:///cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=ipa,dc=example";) +dn: cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=ipa,dc=example +aci: (targetattr = "userpassword")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Enrollment Password";allow (write) groupdn = "ldap:///cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=ipa,dc=example aci: (targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=ipa,dc=example aci: (targetattr = "ipasshpubkey")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example -aci: (targetattr = "description || l || macaddress || nshardwareplatform || nshostlocation || nsosversion")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Modify Hosts";allow (write) groupdn = "ldap:///cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example";) +aci: (targetattr = "description || l || macaddress || nshardwareplatform || nshostlocation || nsosversion || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Modify Hosts";allow (write) groupdn = "ldap:///cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=System: Read Host Membership,cn=permissions,cn=pbac,dc=ipa,dc=example aci: (targetattr = "memberof")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Host Membership";allow (compare,read,search) userdn = "ldap:///all";) dn: cn=System: Read Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example |