diff options
| author | Martin Kosek <mkosek@redhat.com> | 2013-03-13 15:15:41 +0100 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2013-03-22 14:31:22 +0100 |
| commit | b5b040e68f571a858dfe85b65b58687ffc816649 (patch) | |
| tree | 694da7fe90feb5397e6caf5d0854a3c699db4aeb /install | |
| parent | 952a7ac9f55e09eeaa7a24400957aac684a616fb (diff) | |
| download | freeipa-b5b040e68f571a858dfe85b65b58687ffc816649.tar.gz freeipa-b5b040e68f571a858dfe85b65b58687ffc816649.tar.xz freeipa-b5b040e68f571a858dfe85b65b58687ffc816649.zip | |
Configure ipa_dns DS plugin on install and upgrade
The plugin is configured unconditionally (i.e. does not check if
IPA was configured with DNS) as the plugin is needed on all
replicas to prevent objectclass violations due to missing SOA
serial in idnsZone objectclass. The violation could happen if just
one replica configured DNS and added a new zone.
https://fedorahosted.org/freeipa/ticket/3347
Diffstat (limited to 'install')
| -rw-r--r-- | install/updates/40-dns.update | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/install/updates/40-dns.update b/install/updates/40-dns.update index 3478a03ca..7ad366e60 100644 --- a/install/updates/40-dns.update +++ b/install/updates/40-dns.update @@ -41,3 +41,19 @@ replace:aci:'(targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dn # replace DNS tree deny rule with managedBy enhanced allow rule dn: cn=dns, $SUFFIX replace:aci:'(targetattr = "*")(version 3.0; acl "No access to DNS tree without a permission"; deny (read,search,compare) (groupdn != "ldap:///cn=admins,cn=groups,cn=accounts,$SUFFIX") and (groupdn != "ldap:///cn=Read DNS Entries,cn=permissions,cn=pbac,$SUFFIX");)::(targetattr = "*")(version 3.0; acl "Allow read access"; allow (read,search,compare) groupdn = "ldap:///cn=Read DNS Entries,cn=permissions,cn=pbac,$SUFFIX" or userattr = "parent[0,1].managedby#GROUPDN";)' + +# add DNS plugin +dn: cn=IPA DNS,cn=plugins,cn=config +default: objectclass: top +default: objectclass: nsslapdPlugin +default: objectclass: extensibleObject +default: cn: IPA DNS +default: nsslapd-plugindescription: IPA DNS support plugin +default: nsslapd-pluginenabled: on +default: nsslapd-pluginid: ipa_dns +default: nsslapd-plugininitfunc: ipadns_init +default: nsslapd-pluginpath: libipa_dns.so +default: nsslapd-plugintype: preoperation +default: nsslapd-pluginvendor: Red Hat, Inc. +default: nsslapd-pluginversion: 1.0 +default: nsslapd-plugin-depends-on-type: database |