From 68d656f80a483a57f5ed80b7ead03a071abb0ef0 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 5 Sep 2014 15:25:29 +0200
Subject: Fix: Add managed read permissions for compat tree and operational
 attrs

This is a fix for an earlier version, which was committed by mistake as:
master: 418ce870bfbe13cea694a7b862cafe35c703f660
ipa-4-0: 3e2c86aeabbd2e3c54ad73a40803ef2bf5b0cb17
ipa-4-1: 9bcd88589e30d31d3f533cd42d2f816ef01b07c7

Thanks to Alexander Bokovoy for contributions

https://fedorahosted.org/freeipa/ticket/4521
---
 ipalib/plugins/group.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'ipalib/plugins/group.py')

diff --git a/ipalib/plugins/group.py b/ipalib/plugins/group.py
index a4340bb76..8d2e69f06 100644
--- a/ipalib/plugins/group.py
+++ b/ipalib/plugins/group.py
@@ -204,12 +204,12 @@ class group(LDAPObject):
         },
         'System: Read Group Compat Tree': {
             'non_object': True,
-            'ipapermbindruletype': 'all',
+            'ipapermbindruletype': 'anonymous',
             'ipapermlocation': api.env.basedn,
             'ipapermtarget': DN('cn=groups', 'cn=compat', api.env.basedn),
             'ipapermright': {'read', 'search', 'compare'},
             'ipapermdefaultattr': {
-                'objectclass', 'cn', 'memberuid',
+                'objectclass', 'cn', 'memberuid', 'gidnumber',
             },
         },
     }
-- 
cgit