diff options
| author | Thierry bordaz (tbordaz) <tbordaz@redhat.com> | 2015-03-05 14:25:33 +0100 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2015-04-08 08:19:09 +0200 |
| commit | d1691eee88c5462ef1d015617fd5b65eec0319b9 (patch) | |
| tree | 28f824c7135b359291df72292727c1f5452b55bd /install/updates | |
| parent | c3ede5f1e9e8b66a3fb7ec12346e71d05a3a5599 (diff) | |
| download | freeipa-d1691eee88c5462ef1d015617fd5b65eec0319b9.tar.gz freeipa-d1691eee88c5462ef1d015617fd5b65eec0319b9.tar.xz freeipa-d1691eee88c5462ef1d015617fd5b65eec0319b9.zip | |
User life cycle: stageuser-add verb
Add a accounts plugin (accounts class) that defines
variables and methods common to 'users' and 'stageuser'.
accounts is a superclass of users/stageuser
Add the stageuser plugin, with support of stageuser-add verb.
Reviewed By: David Kupka, Martin Basti, Jan Cholasta
https://fedorahosted.org/freeipa/ticket/3813
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
Diffstat (limited to 'install/updates')
| -rw-r--r-- | install/updates/30-provisioning.update | 29 |
1 files changed, 17 insertions, 12 deletions
diff --git a/install/updates/30-provisioning.update b/install/updates/30-provisioning.update index ef6d01a44..11e01df74 100644 --- a/install/updates/30-provisioning.update +++ b/install/updates/30-provisioning.update @@ -1,21 +1,26 @@ # bootstrap the user life cycle DIT structure. dn: cn=provisioning,$SUFFIX -add: objectclass: top -add: objectclass: nsContainer -add: cn: provisioning +default: objectclass: top +default: objectclass: nsContainer +default: cn: provisioning dn: cn=accounts,cn=provisioning,$SUFFIX -add: objectclass: top -add: objectclass: nsContainer -add: cn: accounts +default: objectclass: top +default: objectclass: nsContainer +default: cn: accounts dn: cn=staged users,cn=accounts,cn=provisioning,$SUFFIX -add: objectclass: top -add: objectclass: nsContainer -add: cn: staged users +default: objectclass: top +default: objectclass: nsContainer +default: cn: staged users dn: cn=deleted users,cn=accounts,cn=provisioning,$SUFFIX -add: objectclass: top -add: objectclass: nsContainer -add: cn: staged users +default: objectclass: top +default: objectclass: nsContainer +default: cn: staged users + +# This is used for the admin to know if credential are set for stage users +# We can do a query on a DN to see if an attribute exists. +dn: cn=staged users,cn=accounts,cn=provisioning,$SUFFIX +add:aci: '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///uid=admin,cn=users,cn=accounts,$SUFFIX";)' |