diff options
| author | Jan Cholasta <jcholast@redhat.com> | 2014-06-10 14:07:35 +0200 |
|---|---|---|
| committer | Petr Viktorin <pviktori@redhat.com> | 2014-07-30 16:04:21 +0200 |
| commit | 586373cf077f3761004414c3809785dfbcb6ef46 (patch) | |
| tree | 2d08c859e827dd79079a844c5047dd29c4e8d7ab /install/updates/40-delegation.update | |
| parent | fd80cc1c590a0ca977473ea71ff94e66b6c13f33 (diff) | |
| download | freeipa-586373cf077f3761004414c3809785dfbcb6ef46.tar.gz freeipa-586373cf077f3761004414c3809785dfbcb6ef46.tar.xz freeipa-586373cf077f3761004414c3809785dfbcb6ef46.zip | |
Add permissions for certificate store.
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Diffstat (limited to 'install/updates/40-delegation.update')
| -rw-r--r-- | install/updates/40-delegation.update | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update index 39129b8e4..988de5e19 100644 --- a/install/updates/40-delegation.update +++ b/install/updates/40-delegation.update @@ -74,6 +74,9 @@ add: member: 'cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX' dn: cn=ipa,cn=etc,$SUFFIX add:aci:'(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,$SUFFIX")(targetattr = cACertificate)(version 3.0; acl "Modify CA Certificate"; allow (write) userdn = "ldap:///fqdn=$FQDN,cn=computers,cn=accounts,$SUFFIX";)' +dn: cn=certificates,cn=ipa,cn=etc,$SUFFIX +add:aci:'(targetfilter = "(&(objectClass=ipaCertificate)(ipaConfigString=ipaCA))")(targetattr = "ipaCertIssuerSerial || cACertificate")(version 3.0; acl "Modify CA Certificate Store Entry"; allow (write) userdn = "ldap:///fqdn=$FQDN,cn=computers,cn=accounts,$SUFFIX";)' + # Automember tasks dn: cn=Automember Task Administrator,cn=privileges,cn=pbac,$SUFFIX default:objectClass: nestedgroup |