diff options
author | Rob Crittenden <rcritten@redhat.com> | 2011-05-16 17:39:23 -0400 |
---|---|---|
committer | Rob Crittenden <rcritten@redhat.com> | 2011-05-27 13:51:37 -0400 |
commit | 9cc0754b710500519c6f5fd41a0a0237a43e04b0 (patch) | |
tree | 73534c646557c583290f0b9e070b7d1cf0e553d7 /ipalib/x509.py | |
parent | aa29a8a769c62b07cc4e6d82fc79846505cc9fa3 (diff) | |
download | freeipa-9cc0754b710500519c6f5fd41a0a0237a43e04b0.tar.gz freeipa-9cc0754b710500519c6f5fd41a0a0237a43e04b0.tar.xz freeipa-9cc0754b710500519c6f5fd41a0a0237a43e04b0.zip |
Add option to limit the attributes allowed in an entry.
Kerberos ticket policy can update policy in a user entry. This allowed
set/addattr to be used to modify attributes outside of the ticket policy
perview, also bypassing all validation/normalization. Likewise the
ticket policy was updatable by the user plugin bypassing all validation.
Add two new LDAPObject values to control this behavior:
limit_object_classes: only attributes in these are allowed
disallow_object_classes: attributes in these are disallowed
By default both of these lists are empty so are skipped.
ticket 744
Diffstat (limited to 'ipalib/x509.py')
0 files changed, 0 insertions, 0 deletions