diff options
| author | Petr Viktorin <pviktori@redhat.com> | 2014-06-04 15:21:26 +0200 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2014-06-10 13:55:56 +0200 |
| commit | 53a63ae3461ed3d61bf8355da244ecc2e41b0e9d (patch) | |
| tree | 83f1640187e571daf782f9d95e7e83c59533730a /install/updates/40-delegation.update | |
| parent | e0cafea374ea62e1f59b15ad31a78f7702fac159 (diff) | |
| download | freeipa-53a63ae3461ed3d61bf8355da244ecc2e41b0e9d.tar.gz freeipa-53a63ae3461ed3d61bf8355da244ecc2e41b0e9d.tar.xz freeipa-53a63ae3461ed3d61bf8355da244ecc2e41b0e9d.zip | |
Convert User default permissions to managed
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Diffstat (limited to 'install/updates/40-delegation.update')
| -rw-r--r-- | install/updates/40-delegation.update | 16 |
1 files changed, 0 insertions, 16 deletions
diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update index 3f3b98799..7c3a284b8 100644 --- a/install/updates/40-delegation.update +++ b/install/updates/40-delegation.update @@ -307,14 +307,6 @@ add:aci:'(targetattr = "automountkey || automountinformation || description")(ta replace:aci:'(target = "ldap:///automountkey=*,automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Add Automount keys";allow (add) groupdn = "ldap:///cn=Add Automount keys,cn=permissions,cn=pbac,$SUFFIX";)::(targetfilter = "(objectclass=automount)")(target = "ldap:///automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Add Automount keys";allow (add) groupdn = "ldap:///cn=Add Automount keys,cn=permissions,cn=pbac,$SUFFIX";)' replace:aci:'(target = "ldap:///automountkey=*,automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Remove Automount keys";allow (delete) groupdn = "ldap:///cn=Remove Automount keys,cn=permissions,cn=pbac,$SUFFIX";)::(targetfilter = "(objectclass=automount)")(target = "ldap:///automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Remove Automount keys";allow (delete) groupdn = "ldap:///cn=Remove Automount keys,cn=permissions,cn=pbac,$SUFFIX";)' -# SSH public keys -dn: cn=Manage User SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX -default:objectClass: top -default:objectClass: groupofnames -default:objectClass: ipapermission -default:cn: Manage User SSH Public Keys -default:member: cn=User Administrators,cn=privileges,cn=pbac,$SUFFIX - dn: cn=Manage Host SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX default:objectClass: top default:objectClass: groupofnames @@ -323,16 +315,8 @@ default:cn: Manage Host SSH Public Keys default:member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX dn: $SUFFIX -add:aci:'(targetattr = "ipasshpubkey")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage User SSH Public Keys";allow (write) groupdn = "ldap:///cn=Manage User SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX";)' - -dn: $SUFFIX add:aci:'(targetattr = "ipasshpubkey")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=Manage Host SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX";)' -# Limit the change password permission so it can't change the passwords -# of administrators -dn: $SUFFIX -replace:aci:'(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword || passwordhistory")(version 3.0;acl "permission:Change a user password";allow (write) groupdn = "ldap:///cn=Change a user password,cn=permissions,cn=pbac,$SUFFIX";)::(targetfilter = "(!(memberOf=cn=admins,cn=groups,cn=accounts,$SUFFIX))")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword || passwordhistory")(version 3.0;acl "permission:Change a user password";allow (write) groupdn = "ldap:///cn=Change a user password,cn=permissions,cn=pbac,$SUFFIX";)' - # Don't allow the default 'manage group membership' to be able to manage the # admins group replace:aci:'(targetattr = "member")(target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Group membership";allow (write) groupdn = "ldap:///cn=Modify Group membership,cn=permissions,cn=pbac,$SUFFIX";)::(targetfilter = "(!(cn=admins))")(targetattr = "member")(target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Group membership";allow (write) groupdn = "ldap:///cn=Modify Group membership,cn=permissions,cn=pbac,$SUFFIX";)' |