diff options
| author | Rob Crittenden <rcritten@redhat.com> | 2011-10-05 17:16:05 -0400 |
|---|---|---|
| committer | Rob Crittenden <rcritten@redhat.com> | 2011-10-09 23:44:22 -0400 |
| commit | 7bd3b3e12147b794c4cf2f4457df5e20638c7b0e (patch) | |
| tree | 1f57dd008e2edf1e2e94bb9d0b88200d8720c132 /install/updates/40-dns.update | |
| parent | ae65c0193271b70929f8d011f2a1aa5dff99f426 (diff) | |
| download | freeipa-7bd3b3e12147b794c4cf2f4457df5e20638c7b0e.tar.gz freeipa-7bd3b3e12147b794c4cf2f4457df5e20638c7b0e.tar.xz freeipa-7bd3b3e12147b794c4cf2f4457df5e20638c7b0e.zip | |
Fix DNS permissions and membership in privileges
This resolves two issues:
1. The DNS acis lacked a prefix so weren't tied to permissions
2. The permissions were added before the privileges so the member
values weren't calculated properly
For updates we need to add in the members and recalculate memberof via
a DS task.
https://fedorahosted.org/freeipa/ticket/1898
Diffstat (limited to 'install/updates/40-dns.update')
| -rw-r--r-- | install/updates/40-dns.update | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/install/updates/40-dns.update b/install/updates/40-dns.update new file mode 100644 index 000000000..7b1c45754 --- /dev/null +++ b/install/updates/40-dns.update @@ -0,0 +1,22 @@ +# Add missing member values to attach permissions to their respective +# privileges and run a memberOf task. +dn: cn=add dns entries,cn=permissions,cn=pbac,$SUFFIX +addifexist:member: 'cn=DNS Administrators,cn=privileges,cn=pbac,$SUFFIX' +addifexist:member: 'cn=DNS Servers,cn=privileges,cn=pbac,$SUFFIX' + +dn: cn=remove dns entries,cn=permissions,cn=pbac,$SUFFIX +addifexist:member: 'cn=DNS Administrators,cn=privileges,cn=pbac,$SUFFIX' +addifexist:member: 'cn=DNS Servers,cn=privileges,cn=pbac,$SUFFIX' + +dn: cn=update dns entries,cn=permissions,cn=pbac,$SUFFIX +addifexist:member: 'cn=DNS Administrators,cn=privileges,cn=pbac,$SUFFIX' +addifexist:member: 'cn=DNS Servers,cn=privileges,cn=pbac,$SUFFIX' + +dn: cn=Update PBAC memberOf $TIME, cn=memberof task, cn=tasks, cn=config +add: objectClass: top +add: objectClass: extensibleObject +add: cn: IPA PBAC memberOf $TIME +add: basedn: 'cn=privileges,cn=pbac,$SUFFIX' +add: filter: (objectclass=*) +add: ttl: 10 + |