diff options
| author | Petr Viktorin <pviktori@redhat.com> | 2014-07-04 13:19:37 +0200 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2014-07-04 15:58:14 +0200 |
| commit | 23feb4e0271d6876e2137f301f209a9f3af19084 (patch) | |
| tree | 00a936ed29f419661abc62d18945acec12757f49 /install/updates/20-aci.update | |
| parent | 2f99140c92f05c9ff11ff57002cb87784c632091 (diff) | |
| download | freeipa-23feb4e0271d6876e2137f301f209a9f3af19084.tar.gz freeipa-23feb4e0271d6876e2137f301f209a9f3af19084.tar.xz freeipa-23feb4e0271d6876e2137f301f209a9f3af19084.zip | |
Allow read access to services in cn=masters to auth'd users
https://fedorahosted.org/freeipa/ticket/4425
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Diffstat (limited to 'install/updates/20-aci.update')
| -rw-r--r-- | install/updates/20-aci.update | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/install/updates/20-aci.update b/install/updates/20-aci.update index 5c4d1a1e3..9bbb7e4bb 100644 --- a/install/updates/20-aci.update +++ b/install/updates/20-aci.update @@ -28,9 +28,9 @@ add:aci:'(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)) dn: cn=replicas,cn=ipa,cn=etc,$SUFFIX add:aci:'(targetfilter="(objectclass=nsContainer)")(version 3.0; acl "Deny read access to replica configuration"; deny(read, search, compare) userdn = "ldap:///anyone";)' -# Read access to masters (but not their services) +# Read access to masters and their services dn: cn=masters,cn=ipa,cn=etc,$SUFFIX -add:aci:'(targetfilter="(&(objectclass=nsContainer)(!(objectclass=ipaConfigObject)))")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)' +add:aci:'(targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)' # Read access to Kerberos container (cn=kerberos) and realm containers (cn=$REALM,cn=kerberos) dn: cn=kerberos,$SUFFIX |