From ac68ea3c6c633206a01db5a0b74b994ab0c29093 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Tue, 22 Feb 2011 09:21:14 -0500 Subject: Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles as examples. In doing so I realized that we were completely missing default rules for HBAC, SUDO and password policy so I added those as well. I ran into a problem when the updater has a default record and an add at the same time, it should handle it better now. ticket 585 --- install/share/delegation.ldif | 2 +- install/updates/40-delegation.update | 224 +++++++++++++++++++++++++++++++++++ install/updates/45-roles.update | 90 ++++++++++++++ install/updates/Makefile.am | 3 +- ipaserver/install/ldapupdate.py | 16 ++- 5 files changed, 331 insertions(+), 4 deletions(-) create mode 100644 install/updates/45-roles.update diff --git a/install/share/delegation.ldif b/install/share/delegation.ldif index a15c9ec7..02dc850a 100644 --- a/install/share/delegation.ldif +++ b/install/share/delegation.ldif @@ -42,7 +42,7 @@ changetype: add objectClass: top objectClass: groupofnames objectClass: nestedgroup -cn: entitlements +cn: Entitlement Management description: Entitlements administrator dn: cn=Entitlement Compliance,cn=roles,cn=accounts,$SUFFIX diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update index aa14e85c..32568f92 100644 --- a/install/updates/40-delegation.update +++ b/install/updates/40-delegation.update @@ -5,6 +5,7 @@ default:objectClass: top default:objectClass: groupofnames default:objectClass: nestedgroup default:cn: Write IPA Configuration +default:description: Write IPA Configuration dn: cn=Write IPA Configuration,cn=permissions,cn=pbac,$SUFFIX default:objectClass: top @@ -16,3 +17,226 @@ default:member: cn=Write IPA Configuration,cn=privileges,cn=pbac,$SUFFIX dn: $SUFFIX add:aci: '(targetattr = "ipausersearchfields || ipagroupsearchfields || ipasearchtimelimit || ipasearchrecordslimit || ipacustomfields || ipahomesrootdir || ipadefaultloginshell || ipadefaultprimarygroup || ipamaxusernamelength || ipapwdexpadvnotify || ipauserobjectclasses || ipagroupobjectclasses || ipadefaultemaildomain || ipamigrationenabled || ipacertificatesubjectbase || ipaconfigstring")(target = "ldap:///cn=ipaconfig,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:Write IPA Configuration"; allow (write) groupdn = "ldap:///cn=Write IPA Configuration,cn=permissions,cn=pbac,$SUFFIX";)' +# Host-Based Access Control + +dn: cn=Add HBAC rule,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Add HBAC rule +default:member: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Delete HBAC rule,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Delete HBAC rule +default:member: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Modify HBAC rule,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Modify HBAC rule +default:member: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Manage HBAC rule membership,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Manage HBAC rule membership +default:member: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Add HBAC services,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Add HBAC services +default:member: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Delete HBAC services,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Delete HBAC services +default:member: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Add HBAC service groups,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Add HBAC service groups +default:member: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Delete HBAC service groups,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Delete HBAC service groups +default:member: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Manage HBAC service group membership,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Manage HBAC service group membership +default:member: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX +default:objectClass: nestedgroup +default:objectClass: groupofnames +default:objectClass: top +default:cn: HBAC Administrator +default:description: HBAC Administrator + +dn: $SUFFIX +add:aci: '(target = "ldap:///ipauniqueid=*,cn=hbac,$SUFFIX")(version 3.0;acl "permission:Add HBAC rule";allow (add) groupdn = "ldap:///cn=Add HBAC rule,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(target = "ldap:///ipauniqueid=*,cn=hbac,$SUFFIX")(version 3.0;acl "permission:Delete HBAC rule";allow (delete) groupdn = "ldap:///cn=Delete HBAC rule,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(targetattr = "servicecategory || sourcehostcategory || cn || description || ipaenabledflag || accesstime || usercategory || hostcategory || accessruletype || sourcehost")(target = "ldap:///ipauniqueid=*,cn=hbac,$SUFFIX")(version 3.0;acl "permission:Modify HBAC rule";allow (write) groupdn = "ldap:///cn=Modify HBAC rule,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(targetattr = "memberuser || externalhost || memberservice || memberhost")(target = "ldap:///ipauniqueid=*,cn=hbac,$SUFFIX")(version 3.0;acl "permission:Manage HBAC rule membership";allow (write) groupdn = "ldap:///cn=Manage HBAC rule membership,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(target = "ldap:///cn=*,cn=hbacservices,cn=hbac,$SUFFIX")(version 3.0;acl "permission:Add HBAC services";allow (add) groupdn = "ldap:///cn=Add HBAC services,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(target = "ldap:///cn=*,cn=hbacservices,cn=hbac,$SUFFIX")(version 3.0;acl "permission:Delete HBAC services";allow (delete) groupdn = "ldap:///cn=Delete HBAC services,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(target = "ldap:///cn=*,cn=hbacservicegroups,cn=hbac,$SUFFIX")(version 3.0;acl "permission:Add HBAC service groups";allow (add) groupdn = "ldap:///cn=Add HBAC service groups,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(target = "ldap:///cn=*,cn=hbacservicegroups,cn=hbac,$SUFFIX")(version 3.0;acl "permission:Delete HBAC service groups";allow (delete) groupdn = "ldap:///cn=Delete HBAC service groups,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(targetattr = "member")(target = "ldap:///cn=*,cn=hbacservicegroups,cn=hbac,$SUFFIX")(version 3.0;acl "permission:Manage HBAC service group membership";allow (write) groupdn = "ldap:///cn=Manage HBAC service group membership,cn=permissions,cn=pbac,$SUFFIX";)' + +# SUDO + +dn: cn=Add SUDO rule,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Add SUDO rule +default:member: cn=SUDO Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Delete SUDO rule,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Delete SUDO rule +default:member: cn=SUDO Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Modify SUDO rule,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Modify SUDO rule +default:member: cn=SUDO Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Add SUDO command,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Add SUDO command +default:member: cn=SUDO Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Delete SUDO command,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Delete SUDO command +default:member: cn=SUDO Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Modify SUDO command,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Modify SUDO command +default:member: cn=SUDO Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Add SUDO command group,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Add SUDO command group +default:member: cn=SUDO Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Delete SUDO command group,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Delete SUDO command group +default:member: cn=SUDO Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Manage SUDO command group membership,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Manage SUDO command group membership +default:member: cn=SUDO Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=SUDO Administrator,cn=privileges,cn=pbac,$SUFFIX +default:objectClass: nestedgroup +default:objectClass: groupofnames +default:objectClass: top +default:cn: SUDO Administrator +default:description: SUDO Administrator + +dn: $SUFFIX +add:aci: '(target = "ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Add SUDO rule";allow (add) groupdn = "ldap:///cn=Add SUDO rule,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(target = "ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Delete SUDO rule";allow (delete) groupdn = "ldap:///cn=Delete SUDO rule,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(targetattr = "description || ipaenabledflag || usercategory || hostcategory || cmdcategory || ipasudorunasusercategory || ipasudorunasgroupcategory || externaluser || ipasudorunasextuser || ipasudorunasextgroup || memberdenycmd || memberallowcmd || memberuser")(target = "ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Modify SUDO rule";allow (write) groupdn = "ldap:///cn=Modify SUDO rule,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(targetattr = "description")(target = "ldap:///sudocmd=*,cn=sudocmds,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Modify SUDO command";allow (write) groupdn = "ldap:///cn=Modify SUDO command,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(target = "ldap:///sudocmd=*,cn=sudocmds,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Delete SUDO command";allow (delete) groupdn = "ldap:///cn=Delete SUDO command,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(target = "ldap:///sudocmd=*,cn=sudocmds,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Add SUDO command";allow (add) groupdn = "ldap:///cn=Add SUDO command,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(target = "ldap:///cn=*,cn=sudocmdgroups,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Add SUDO command group";allow (add) groupdn = "ldap:///cn=Add SUDO command group,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(target = "ldap:///cn=*,cn=sudocmdgroups,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Delete SUDO command group";allow (delete) groupdn = "ldap:///cn=Delete SUDO command group,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(targetattr = "member")(target = "ldap:///cn=*,cn=sudocmdgroups,cn=sudo,$SUFFIX")(version 3.0;acl "permission:Manage SUDO command group membership";allow (write) groupdn = "ldap:///cn=Manage SUDO command group membership,cn=permissions,cn=pbac,$SUFFIX";)' + +# Password Policy +dn: cn=Add Group Password Policy costemplate,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Add Group Password Policy costemplate +default:member: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Delete Group Password Policy costemplate,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Delete Group Password Policy costemplate +default:member: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Modify Group Password Policy costemplate,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Modify Group Password Policy costemplate +default:member: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Add Group Password Policy,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Add Group Password Policy +default:member: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Delete Group Password Policy,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Delete Group Password Policy +default:member: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Modify Group Password Policy,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: groupofnames +default:objectClass: ipapermission +default:objectClass: top +default:cn: Modify Group Password Policy +default:member: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX +default:objectClass: nestedgroup +default:objectClass: groupofnames +default:objectClass: top +default:cn: Password Policy Administrator +default:description: Password Policy Administrator + +dn: $SUFFIX +add:aci: '(target = "ldap:///cn=*,cn=costemplates,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Add Group Password Policy costemplate";allow (add) groupdn = "ldap:///cn=Add Group Password Policy costemplate,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(target = "ldap:///cn=*,cn=costemplates,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Delete Group Password Policy costemplate";allow (delete) groupdn = "ldap:///cn=Delete Group Password Policy costemplate,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(targetattr = "cospriority")(target = "ldap:///cn=*,cn=costemplates,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Group Password Policy costemplate";allow (write) groupdn = "ldap:///cn=Modify Group Password Policy costemplate,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(target = "ldap:///cn=*,cn=$REALM,cn=kerberos,$SUFFIX")(version 3.0;acl "permission:Add Group Password Policy";allow (add) groupdn = "ldap:///cn=Add Group Password Policy,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(target = "ldap:///cn=*,cn=$REALM,cn=kerberos,$SUFFIX")(version 3.0;acl "permission:Delete Group Password Policy";allow (delete) groupdn = "ldap:///cn=Delete Group Password Policy,cn=permissions,cn=pbac,$SUFFIX";)' +add:aci: '(targetattr = "krbmaxpwdlife || krbminpwdlife || krbpwdhistorylength || krbpwdmindiffchars || krbpwdminlength || krbpwdmaxfailure || krbpwdfailurecountinterval || krbpwdlockoutduration")(target = "ldap:///cn=*,cn=$REALM,cn=kerberos,$SUFFIX")(version 3.0;acl "permission:Modify Group Password Policy";allow (write) groupdn = "ldap:///cn=Modify Group Password Policy,cn=permissions,cn=pbac,$SUFFIX";)' diff --git a/install/updates/45-roles.update b/install/updates/45-roles.update new file mode 100644 index 00000000..7c08f667 --- /dev/null +++ b/install/updates/45-roles.update @@ -0,0 +1,90 @@ +# Helpdesk roles +dn: cn=Modify Users and Reset passwords,cn=privileges,cn=pbac,$SUFFIX +default:objectClass: top +default:objectClass: groupofnames +default:objectClass: nestedgroup +default:cn: Modify Users and Reset passwords +default:description: Modify Users and Reset passwords +default:member: cn=helpdesk,cn=roles,cn=accounts,$SUFFIX + +dn: cn=Change a user password,cn=permissions,cn=pbac,$SUFFIX +add:member: 'cn=Modify Users and Reset passwords,cn=privileges,cn=pbac,$SUFFIX' + +dn: cn=Modify Users,cn=permissions,cn=pbac,$SUFFIX +add:member: 'cn=Modify Users and Reset passwords,cn=privileges,cn=pbac,$SUFFIX' + +dn: cn=Modify Group membership,cn=privileges,cn=pbac,$SUFFIX +default:objectClass: top +default:objectClass: groupofnames +default:objectClass: nestedgroup +default:cn: Modify Group membership +default:description: Modify Group membership +default:member: cn=helpdesk,cn=roles,cn=accounts,$SUFFIX + +dn: cn=User Administrator,cn=roles,cn=accounts,$SUFFIX +default:objectClass: groupofnames +default:objectClass: nestedgroup +default:objectClass: top +default:cn: User Administrator +default:description: Responsible for creating Users and Groups + +dn: cn=User Administrators,cn=privileges,cn=pbac,$SUFFIX +add: member: 'cn=User Administrator,cn=roles,cn=accounts,$SUFFIX' + +dn: cn=Group Administrators,cn=privileges,cn=pbac,$SUFFIX +add: member: 'cn=User Administrator,cn=roles,cn=accounts,$SUFFIX' + +dn: cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX +default:objectClass: groupofnames +default:objectClass: nestedgroup +default:objectClass: top +default:cn: IT Specialist +default:description: IT Specialist + +dn: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX +add:member: 'cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX' + +dn: cn=Host Group Administrators,cn=privileges,cn=pbac,$SUFFIX +add:member: 'cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX' + +dn: cn=Service Administrators,cn=privileges,cn=pbac,$SUFFIX +add:member: 'cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX' + +dn: cn=Automount Administrators,cn=privileges,cn=pbac,$SUFFIX +add:member: 'cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX' + +dn: cn=IT Security Specialist,cn=roles,cn=accounts,$SUFFIX +default:objectClass: groupofnames +default:objectClass: nestedgroup +default:objectClass: top +default:cn: IT Security Specialist +default:description: IT Security Specialist + +dn: cn=Netgroups Administrators,cn=privileges,cn=pbac,$SUFFIX +add:member: 'cn=IT Security Specialist,cn=roles,cn=accounts,$SUFFIX' + +dn: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX +add:member: 'cn=IT Security Specialist,cn=roles,cn=accounts,$SUFFIX' + +dn: cn=SUDO administrator,cn=privileges,cn=pbac,$SUFFIX +add:member: 'cn=IT Security Specialist,cn=roles,cn=accounts,$SUFFIX' + +dn: cn=Security Architect,cn=roles,cn=accounts,$SUFFIX +default:objectClass: groupofnames +default:objectClass: nestedgroup +default:objectClass: top +default:cn: Security Architect +default:description: Security Architect + +dn: cn=Delegation Administrator,cn=privileges,cn=pbac,$SUFFIX +add:member: 'cn=Security Architect,cn=roles,cn=accounts,$SUFFIX' + +dn: cn=Replication Administrators,cn=privileges,cn=pbac,$SUFFIX +add:member: 'cn=Security Architect,cn=roles,cn=accounts,$SUFFIX' + +dn: cn=Write IPA Configuration,cn=privileges,cn=pbac,$SUFFIX +add:member: 'cn=Security Architect,cn=roles,cn=accounts,$SUFFIX' + +dn: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX +add:member: 'cn=Security Architect,cn=roles,cn=accounts,$SUFFIX' + diff --git a/install/updates/Makefile.am b/install/updates/Makefile.am index c3473ace..5b45c6ef 100644 --- a/install/updates/Makefile.am +++ b/install/updates/Makefile.am @@ -11,7 +11,8 @@ app_DATA = \ 20-replication.update \ 20-winsync_index.update \ 40-delegation.update \ - 50-lockout-policy.update \ + 50-lockout-policy.update \ + 45-roles.update \ $(NULL) EXTRA_DIST = \ diff --git a/ipaserver/install/ldapupdate.py b/ipaserver/install/ldapupdate.py index e7411e3f..95890495 100644 --- a/ipaserver/install/ldapupdate.py +++ b/ipaserver/install/ldapupdate.py @@ -213,7 +213,18 @@ class LDAPUpdate: return all_updates e = all_updates[dn] - e['updates'] = e['updates'] + update['updates'] + if 'default' in update: + if 'default' in e: + e['default'] = e['default'] + update['default'] + else: + e['default'] = update['default'] + elif 'updates' in update: + if 'updates' in e: + e['updates'] = e['updates'] + update['updates'] + else: + e['updates'] = update['updates'] + else: + logging.debug("Unknown key in updates %s" % update.keys()) all_updates[dn] = e @@ -289,7 +300,8 @@ class LDAPUpdate: """Create a task to update an index for an attribute""" # Sleep a bit to ensure previous operations are complete - time.sleep(5) + if self.live_run: + time.sleep(5) r = random.SystemRandom() -- cgit