diff options
| author | Petr Viktorin <pviktori@redhat.com> | 2014-06-04 17:39:10 +0200 |
|---|---|---|
| committer | Petr Viktorin <pviktori@redhat.com> | 2014-06-18 14:56:43 +0200 |
| commit | 49e83256b4f3ebe05c9e9fab5a55c6d502faf491 (patch) | |
| tree | 4e75676aea9366449359d87cf6e4d1351d095162 /install | |
| parent | ca465e8ae774e88cff6916ee7640ab337890c739 (diff) | |
| download | freeipa-49e83256b4f3ebe05c9e9fab5a55c6d502faf491.tar.gz freeipa-49e83256b4f3ebe05c9e9fab5a55c6d502faf491.tar.xz freeipa-49e83256b4f3ebe05c9e9fab5a55c6d502faf491.zip | |
Convert Password Policy default permissions to managed
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Diffstat (limited to 'install')
| -rw-r--r-- | install/updates/40-delegation.update | 26 |
1 files changed, 0 insertions, 26 deletions
diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update index 690f02eeb..889f3a1f6 100644 --- a/install/updates/40-delegation.update +++ b/install/updates/40-delegation.update @@ -170,32 +170,6 @@ default:objectClass: top default:cn: Password Policy Administrator default:description: Password Policy Administrator -dn: cn=Add Group Password Policy,cn=permissions,cn=pbac,$SUFFIX -default:objectClass: groupofnames -default:objectClass: ipapermission -default:objectClass: top -default:cn: Add Group Password Policy -default:member: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX - -dn: cn=Delete Group Password Policy,cn=permissions,cn=pbac,$SUFFIX -default:objectClass: groupofnames -default:objectClass: ipapermission -default:objectClass: top -default:cn: Delete Group Password Policy -default:member: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX - -dn: cn=Modify Group Password Policy,cn=permissions,cn=pbac,$SUFFIX -default:objectClass: groupofnames -default:objectClass: ipapermission -default:objectClass: top -default:cn: Modify Group Password Policy -default:member: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX - -dn: $SUFFIX -add:aci: '(target = "ldap:///cn=*,cn=$REALM,cn=kerberos,$SUFFIX")(version 3.0;acl "permission:Add Group Password Policy";allow (add) groupdn = "ldap:///cn=Add Group Password Policy,cn=permissions,cn=pbac,$SUFFIX";)' -add:aci: '(target = "ldap:///cn=*,cn=$REALM,cn=kerberos,$SUFFIX")(version 3.0;acl "permission:Delete Group Password Policy";allow (delete) groupdn = "ldap:///cn=Delete Group Password Policy,cn=permissions,cn=pbac,$SUFFIX";)' -add:aci: '(targetattr = "krbmaxpwdlife || krbminpwdlife || krbpwdhistorylength || krbpwdmindiffchars || krbpwdminlength || krbpwdmaxfailure || krbpwdfailurecountinterval || krbpwdlockoutduration")(target = "ldap:///cn=*,cn=$REALM,cn=kerberos,$SUFFIX")(version 3.0;acl "permission:Modify Group Password Policy";allow (write) groupdn = "ldap:///cn=Modify Group Password Policy,cn=permissions,cn=pbac,$SUFFIX";)' - # Allow an admin to enroll a host that has a one-time password. # When a host is created with a password no krbPrincipalName is set. # This will let it be added if the client ends up enrolling with |