diff options
| author | Thierry bordaz (tbordaz) <tbordaz@redhat.com> | 2014-08-07 16:29:02 +0200 |
|---|---|---|
| committer | Petr Viktorin <pviktori@redhat.com> | 2014-08-19 09:48:20 +0200 |
| commit | 04ea75a7a5109907ede2a0216bd39fac46a992c0 (patch) | |
| tree | 4578f63b2a8f1dd11fa3d89727841e0b698cf9e1 /install/updates/20-dna.update | |
| parent | 359dfe58b94079e1e16f4fb8960eb29b251f2cbc (diff) | |
| download | freeipa-04ea75a7a5109907ede2a0216bd39fac46a992c0.tar.gz freeipa-04ea75a7a5109907ede2a0216bd39fac46a992c0.tar.xz freeipa-04ea75a7a5109907ede2a0216bd39fac46a992c0.zip | |
User Life Cycle: create containers and scoping DS plugins
User Life Cycle is designed http://www.freeipa.org/page/V4/User_Life-Cycle_Management
It manages 3 containers (Staging, Active, Delete). At install/upgrade Delete and Staging
containers needs to be created.
Active: cn=users,cn=accounts,$SUFFIX
Delete: cn=deleted users,cn=accounts,cn=provisioning,$SUFFIX
Stage: cn=staged users ,cn=accounts,cn=provisioning,$SUFFIX
Plugins scopes:
krbPrincipalName, krbCanonicalName, ipaUniqueID, uid:
cn=accounts,SUFFIX
cn=deleted users,cn=accounts,cn=provisioning,SUFFIX
DNA:
cn=accounts,SUFFIX
Plugins exclude subtree:
IPA UUID, Referential Integrity, memberOf:
cn=provisioning,SUFFIX
https://fedorahosted.org/freeipa/ticket/3813
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Diffstat (limited to 'install/updates/20-dna.update')
| -rw-r--r-- | install/updates/20-dna.update | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/install/updates/20-dna.update b/install/updates/20-dna.update index 04047dd12..719195e92 100644 --- a/install/updates/20-dna.update +++ b/install/updates/20-dna.update @@ -2,9 +2,11 @@ dn: cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config only:nsslapd-pluginEnabled: on -# Change the magic value to -1 +# Change the magic value to -1 and restrict DNA to active accounts dn: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config only:dnaMagicRegen: -1 +remove:dnaScope: '$SUFFIX' +add:dnaScope: 'cn=accounts,$SUFFIX' dn: cn=ipa-winsync,cn=plugins,cn=config remove:ipaWinSyncUserAttr: uidNumber 999 |