diff options
| author | Rob Crittenden <rcritten@redhat.com> | 2010-12-17 15:04:47 -0500 |
|---|---|---|
| committer | Adam Young <ayoung@redhat.com> | 2010-12-17 17:16:25 -0500 |
| commit | 1207a7c83f89fccbd38c28e2c0c2307a55956a9d (patch) | |
| tree | 0572b05bc80f2749847348e7d7578d574ba4dc09 /install/share/delegation.ldif | |
| parent | b66c680f862e1dd2ff788ec593fb2f5dee7e43ab (diff) | |
| download | freeipa-1207a7c83f89fccbd38c28e2c0c2307a55956a9d.tar.gz freeipa-1207a7c83f89fccbd38c28e2c0c2307a55956a9d.tar.xz freeipa-1207a7c83f89fccbd38c28e2c0c2307a55956a9d.zip | |
Fix the change_password permissions and the DNS access controls.
The change_password permission was too broad, limit it to users.
The DNS access controls rolled everything into a single ACI. I broke
it out into separate ACIs for add, delete and add. I also added a new
dns type for the permission plugin.
ticket 628
Diffstat (limited to 'install/share/delegation.ldif')
| -rw-r--r-- | install/share/delegation.ldif | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/install/share/delegation.ldif b/install/share/delegation.ldif index 7881a029d..d87b6c260 100644 --- a/install/share/delegation.ldif +++ b/install/share/delegation.ldif @@ -493,7 +493,7 @@ dn: $SUFFIX changetype: modify add: aci aci: (target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "Add Users";allow (add) groupdn = "ldap:///cn=addusers,cn=permissions,cn=accounts,$SUFFIX";) -aci: (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0;acl "Change a user password";allow (write) groupdn = "ldap:///cn=change_password,cn=permissions,cn=accounts,$SUFFIX";) +aci: (target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0;acl "Change a user password";allow (write) groupdn = "ldap:///cn=change_password,cn=permissions,cn=accounts,$SUFFIX";) aci: (targetattr = "member")(target = "ldap:///cn=ipausers,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "Add user to default group";allow (write) groupdn = "ldap:///cn=add_user_to_default_group,cn=permissions,cn=accounts,$SUFFIX";) aci: (target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "Remove Users";allow (delete) groupdn = "ldap:///cn=removeusers,cn=permissions,cn=accounts,$SUFFIX";) aci: (targetattr = "givenName || sn || cn || displayName || title || initials || loginShell || gecos || homePhone || mobile || pager || facsimileTelephoneNumber || telephoneNumber || street || roomNumber || l || st || postalCode || manager || secretary || description || carLicense || labeledURI || inetUserHTTPURL || seeAlso || employeeType || businessCategory || ou || mepManagedEntry || objectclass")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "Modify Users";allow (write) groupdn = "ldap:///cn=modifyusers,cn=permissions,cn=accounts,$SUFFIX";) |