diff options
| author | Thierry Bordaz <tbordaz@redhat.com> | 2015-05-08 10:41:44 +0200 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2015-05-18 09:37:21 +0200 |
| commit | 51937cc571ec8ea5e782b8dcd45f0ec5fe0f310b (patch) | |
| tree | 814d8c84a4e54d817164208858425c3db42f15a0 /install/updates | |
| parent | c9e1ad0dbc28c6c5b0e7381144a969f6b77d504d (diff) | |
| download | freeipa-51937cc571ec8ea5e782b8dcd45f0ec5fe0f310b.tar.gz freeipa-51937cc571ec8ea5e782b8dcd45f0ec5fe0f310b.tar.xz freeipa-51937cc571ec8ea5e782b8dcd45f0ec5fe0f310b.zip | |
User life cycle: Stage user Administrators permission/priviledge
Creation of stage user administrator
https://fedorahosted.org/freeipa/ticket/3813
Reviewed-By: David Kupka <dkupka@redhat.com>
Diffstat (limited to 'install/updates')
| -rw-r--r-- | install/updates/30-provisioning.update | 1 | ||||
| -rw-r--r-- | install/updates/45-roles.update | 3 |
2 files changed, 4 insertions, 0 deletions
diff --git a/install/updates/30-provisioning.update b/install/updates/30-provisioning.update index f1666ff3a..b8ec80e00 100644 --- a/install/updates/30-provisioning.update +++ b/install/updates/30-provisioning.update @@ -26,6 +26,7 @@ dn: cn=staged users,cn=accounts,cn=provisioning,$SUFFIX add:aci: (targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(read, search) userdn = "ldap:///uid=admin,cn=users,cn=accounts,$SUFFIX";) # This is used for the admin to reset the delete users credential +# No one is allowed to add entry in Delete container dn: cn=deleted users,cn=accounts,cn=provisioning,$SUFFIX add:aci: (targetattr="userPassword || krbPrincipalKey || krbPasswordExpiration || krbLastPwdChange")(version 3.0; acl "Admins allowed to reset password and kerberos keys"; allow(read, search, write) userdn = "ldap:///uid=admin,cn=users,cn=accounts,$SUFFIX";) add:aci: (targetattr = "*")(version 3.0; acl "No one can add entry in Delete container"; deny (add) userdn = "ldap:///all";) diff --git a/install/updates/45-roles.update b/install/updates/45-roles.update index 3442c7bf8..eb50e2b9c 100644 --- a/install/updates/45-roles.update +++ b/install/updates/45-roles.update @@ -28,6 +28,9 @@ add: member: cn=User Administrator,cn=roles,cn=accounts,$SUFFIX dn: cn=Group Administrators,cn=privileges,cn=pbac,$SUFFIX add: member: cn=User Administrator,cn=roles,cn=accounts,$SUFFIX +dn: cn=Stage User Administrators,cn=privileges,cn=pbac,$SUFFIX +add: member: cn=User Administrator,cn=roles,cn=accounts,$SUFFIX + dn: cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX default:objectClass: groupofnames default:objectClass: nestedgroup |