diff options
| author | Rob Crittenden <rcritten@redhat.com> | 2011-05-16 17:39:23 -0400 |
|---|---|---|
| committer | Rob Crittenden <rcritten@redhat.com> | 2011-05-27 13:51:37 -0400 |
| commit | 9cc0754b710500519c6f5fd41a0a0237a43e04b0 (patch) | |
| tree | 73534c646557c583290f0b9e070b7d1cf0e553d7 /API.txt | |
| parent | aa29a8a769c62b07cc4e6d82fc79846505cc9fa3 (diff) | |
| download | freeipa-9cc0754b710500519c6f5fd41a0a0237a43e04b0.tar.gz freeipa-9cc0754b710500519c6f5fd41a0a0237a43e04b0.tar.xz freeipa-9cc0754b710500519c6f5fd41a0a0237a43e04b0.zip | |
Add option to limit the attributes allowed in an entry.
Kerberos ticket policy can update policy in a user entry. This allowed
set/addattr to be used to modify attributes outside of the ticket policy
perview, also bypassing all validation/normalization. Likewise the
ticket policy was updatable by the user plugin bypassing all validation.
Add two new LDAPObject values to control this behavior:
limit_object_classes: only attributes in these are allowed
disallow_object_classes: attributes in these are disallowed
By default both of these lists are empty so are skipped.
ticket 744
Diffstat (limited to 'API.txt')
0 files changed, 0 insertions, 0 deletions