summaryrefslogtreecommitdiffstats
path: root/install/share/delegation.ldif
diff options
context:
space:
mode:
authorRob Crittenden <rcritten@redhat.com>2011-01-20 12:51:59 -0500
committerRob Crittenden <rcritten@redhat.com>2011-01-24 14:33:21 -0500
commit6e7729726f6e87dc117d284719d3f68833056a28 (patch)
tree0a279a7c2901353ca9b824aee049f132770272a5 /install/share/delegation.ldif
parent9319385c7e9b103b7fd16a5415e2c0317e3fb566 (diff)
downloadfreeipa-6e7729726f6e87dc117d284719d3f68833056a28.tar.gz
freeipa-6e7729726f6e87dc117d284719d3f68833056a28.tar.xz
freeipa-6e7729726f6e87dc117d284719d3f68833056a28.zip
Block anonymous access to HBAC, role and some member information.
Prevents an unauthenticated user from accessing HBAC and role information as well as memberof which could disclose roles, memberships in HBAC, etc. ticket 811
Diffstat (limited to 'install/share/delegation.ldif')
-rw-r--r--install/share/delegation.ldif5
1 files changed, 5 insertions, 0 deletions
diff --git a/install/share/delegation.ldif b/install/share/delegation.ldif
index 79b5159da..9a96365d5 100644
--- a/install/share/delegation.ldif
+++ b/install/share/delegation.ldif
@@ -558,6 +558,11 @@ aci: (targetattr = "usercertificate")(target = "ldap:///krbprincipalname=*,cn=se
dn: $SUFFIX
changetype: modify
add: aci
+aci: (targetattr = "*")(target = "ldap:///cn=*,cn=roles,cn=accounts,$SUFFIX")(version 3.0; acl "No anonymous access to roles"; deny (read,search,compare) userdn != "ldap:///all";)
+
+dn: $SUFFIX
+changetype: modify
+add: aci
aci: (target = "ldap:///cn=*,cn=roles,cn=accounts,$SUFFIX")(version 3.0;acl "Add Roles";allow (add) groupdn = "ldap:///cn=addroles,cn=permissions,cn=pbac,$SUFFIX";)
aci: (target = "ldap:///cn=*,cn=roles,cn=accounts,$SUFFIX")(version 3.0;acl "Remove Roles";allow (delete) groupdn = "ldap:///cn=removeroles,cn=permissions,cn=pbac,$SUFFIX";)
aci: (targetattr = "cn || description")(target = "ldap:///cn=*,cn=roles,cn=accounts,$SUFFIX")(version 3.0; acl "Modify Roles";allow (write) groupdn = "ldap:///cn=modifyroles,cn=permissions,cn=pbac,$SUFFIX";)