summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--install/share/Makefile.am1
-rw-r--r--install/share/delegation.ldif12
-rw-r--r--install/share/replica-acis.ldif11
-rw-r--r--ipaserver/install/dsinstance.py5
4 files changed, 17 insertions, 12 deletions
diff --git a/install/share/Makefile.am b/install/share/Makefile.am
index f9cc980d8..b3673180d 100644
--- a/install/share/Makefile.am
+++ b/install/share/Makefile.am
@@ -17,6 +17,7 @@ app_DATA = \
default-keytypes.ldif \
default-pwpolicy.ldif \
delegation.ldif \
+ replica-acis.ldif \
ds-nfiles.ldif \
dns.ldif \
kerberos.ldif \
diff --git a/install/share/delegation.ldif b/install/share/delegation.ldif
index 69050dfee..1399c7c8c 100644
--- a/install/share/delegation.ldif
+++ b/install/share/delegation.ldif
@@ -592,18 +592,6 @@ changetype: modify
add: aci
aci: (targetattr = "enrolledby || objectclass")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "Enroll a host";allow (write) groupdn = "ldap:///cn=enroll_host,cn=permissions,cn=accounts,$SUFFIX";)
-# Replica administration
-
-dn: cn="$SUFFIX",cn=mapping tree,cn=config
-changetype: modify
-add: aci
-aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0; acl "Manage Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=managereplica,cn=permissions,cn=accounts,$SUFFIX";)
-
-dn: cn="$SUFFIX",cn=mapping tree,cn=config
-changetype: modify
-add: aci
-aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "Delete Replication Agreements";allow (delete) groupdn = "ldap:///cn=deletereplica,cn=permissions,cn=accounts,$SUFFIX";)
-
# Entitlement administration
dn: $SUFFIX
diff --git a/install/share/replica-acis.ldif b/install/share/replica-acis.ldif
new file mode 100644
index 000000000..5ee65dacb
--- /dev/null
+++ b/install/share/replica-acis.ldif
@@ -0,0 +1,11 @@
+# Replica administration
+
+dn: cn="$SUFFIX",cn=mapping tree,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0; acl "Manage Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=managereplica,cn=permissions,cn=accounts,$SUFFIX";)
+
+dn: cn="$SUFFIX",cn=mapping tree,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "Delete Replication Agreements";allow (delete) groupdn = "ldap:///cn=deletereplica,cn=permissions,cn=accounts,$SUFFIX";)
diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py
index 3dbedfb8b..73bc8b0c1 100644
--- a/ipaserver/install/dsinstance.py
+++ b/ipaserver/install/dsinstance.py
@@ -245,6 +245,7 @@ class DsInstance(service.Service):
self.step("adding default layout", self.__add_default_layout)
self.step("adding delegation layout", self.__add_delegation_layout)
+ self.step("adding replication acis", self.__add_replication_acis)
if hbac_allow:
self.step("creating default HBAC rule allow_all", self.add_hbac)
@@ -278,6 +279,7 @@ class DsInstance(service.Service):
self.__common_setup()
self.step("Setting up initial replication", self.__setup_replica)
+ self.step("adding replication acis", self.__add_replication_acis)
self.__common_post_setup()
@@ -534,6 +536,9 @@ class DsInstance(service.Service):
def __add_delegation_layout(self):
self._ldap_mod("delegation.ldif", self.sub_dict)
+ def __add_replication_acis(self):
+ self._ldap_mod("replica-acis.ldif", self.sub_dict)
+
def __create_indices(self):
self._ldap_mod("indices.ldif")