summaryrefslogtreecommitdiffstats
path: root/install/share/60basev3.ldif
Commit message (Collapse)AuthorAgeFilesLines
* permissions: Use multivalued targetfilterPetr Viktorin2014-02-201-1/+1
| | | | | | | | | | | | | | | | Change the target filter to be multivalued. Make the `type` option on permissions set location and an (objectclass=...) targetfilter, instead of location and target. Make changing or unsetting `type` remove existing (objectclass=...) targetfilters only, and similarly, changing/unsetting `memberof` to remove (memberof=...) only. Update tests Part of the work for: https://fedorahosted.org/freeipa/ticket/4074 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add support for managed permissionsPetr Viktorin2014-02-121-2/+2
| | | | | | | | | | | | | | | | This adds support for managed permissions. The attribute list of these is computed from the "default" (modifiable only internally), "allowed", and "excluded" lists. This makes it possible to cleanly merge updated IPA defaults and user changes on upgrades. The default managed permissions are to be added in a future patch. For now they can only be created manually (see test_managed_permissions). Tests included. Part of the work for: https://fedorahosted.org/freeipa/ticket/4033 Design: http://www.freeipa.org/page/V3/Managed_Read_permissions Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add new permission schemaPetr Viktorin2013-12-131-0/+9
| | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Design: http://www.freeipa.org/page/V3/Permissions_V2
* Add userClass attribute for usersAna Krivokapic2013-11-191-0/+1
| | | | | | | | | This new freeform user attribute will allow provisioning systems to add custom tags for user objects which can be later used for automember rules or for additional local interpretation. Design page: http://www.freeipa.org/page/V3/Integration_with_a_provisioning_systems https://fedorahosted.org/freeipa/ticket/3588
* Unify capitalization of attribute names in schema filesPetr Viktorin2013-11-181-1/+1
| | | | | | | | | | | Due to a bug[0], python-ldap doesn't parse schema LDIF files correctly if they use inconsistent capitalization. This patch works around the bug in IPA schema files. [0] https://bugzilla.redhat.com/show_bug.cgi?id=1007820 Note: git's --word-diff option is recommended for viewing these changes
* Make schema files conform to new updaterPetr Viktorin2013-11-181-3/+3
| | | | | | | | | | | | | | | | | The new schema updater only compares textual representations of schema elements, as formatted by python-ldap. This works well, but it is too strict for the current schema files in two ways: - For attribute names in MAY and MUST, the correct letter case must be used - AttributeTypes must specify explicit EQUALITY and SYNTAX fields even if they are the same as its supertype's. When these restrictions are not followed, the updater will always overwrite the schema element. This is harmless but it fills up the log unnecessarily. Modify the schema files to conform to these restrictions. Part of the work for https://fedorahosted.org/freeipa/ticket/3454 Note: git's --word-diff option is recommended for viewing these changes
* Add ipaRangeType attribute to LDAP SchemaTomas Babej2013-06-101-1/+2
| | | | | | | | | | This adds a new LDAP attribute ipaRangeType with OID 2.16.840.1.113730.3.8.11.41 to the LDAP Schema. ObjectClass ipaIDrange has been altered to require ipaRangeType attribute. Part of https://fedorahosted.org/freeipa/ticket/3647
* Add ipaUserAuthType and ipaUserAuthTypeClassNathaniel McCallum2013-05-171-0/+2
| | | | | | | | | | This schema addition will be useful for future commits. It allows us to define permitted external authentication methods on both the user and global config. The implementation is generic, but the immediate usage is for otp support. https://fedorahosted.org/freeipa/ticket/3365 http://freeipa.org/page/V3/OTP
* Remove ORDERING for IA5 attributeTypesMartin Kosek2013-02-271-3/+3
| | | | | | | | IA5 string syntax does not have a compatible ORDERING matching rule. Simply use default ORDERING for these attributeTypes as we already do in other cases. https://fedorahosted.org/freeipa/ticket/3398
* Add missing v3 schema on upgrades, fix typo in schema.Rob Crittenden2013-02-221-9/+9
| | | | | | | | Add mising ipaExternalMember attribute and ipaExternalGroup objectclass. Replacing mis-spelled ORDERING value on new install and upgrades. https://fedorahosted.org/freeipa/ticket/3398
* Add SID blacklist attributesMartin Kosek2013-02-121-1/+3
| | | | | | | | Update our LDAP schema and add 2 new attributes for SID blacklist definition. These new attributes can now be set per-trust with trustconfig command. https://fedorahosted.org/freeipa/ticket/3289
* Add per-service option to store the types of PAC it supportsRob Crittenden2012-08-011-0/+1
| | | | | | Create a per-service default as well. https://fedorahosted.org/freeipa/ticket/2184
* Extend LDAP schemaSumit Bose2012-06-291-0/+8
| | | | | | | | | | | The objectclass ipaIDobject can be used to reserve local UIDs, GIDs or SIDs for objects that are no neither users nor groups. The ipa*IDRange objectclasses will be used to store the used Posix ID ranges of the local domains (ipaDomainIDRange) or the ranges reserved for AD domains (ipaTrustedADDomainRange). To be able to map the Posix IDs to a RID and back the corresponding ranges can be saved here as well.
* Add separate attribute to store trusted domain SIDAlexander Bokovoy2012-06-071-1/+2
| | | | | | | | | | | We need two attributes in the ipaNTTrustedDomain objectclass to store different kind of SID. Currently ipaNTSecurityIdentifier is used to store the Domain-SID of the trusted domain. A second attribute is needed to store the SID for the trusted domain user. Since it cannot be derived safely from other values and since it does not make sense to create a separate object for the user a new attribute is needed. https://fedorahosted.org/freeipa/ticket/2191
* Add LDAP schema for SSH public keys.Jan Cholasta2012-02-131-0/+4
| | | | https://fedorahosted.org/freeipa/ticket/754
* Add SELinux user mapping framework.Rob Crittenden2011-12-091-0/+2
| | | | | | | | This will allow one to define what SELinux context a given user gets on a given machine. A rule can contain a set of users and hosts or it can point to an existing HBAC rule that defines them. https://fedorahosted.org/freeipa/ticket/755
* ipa-kdb: Delegation ACL schemaSimo Sorce2011-12-081-0/+5
|
* Add trust objectclass and attributes to v3 schemaSumit Bose2011-12-061-0/+10
|
* Add NT domain GUID attribute.Simo Sorce2011-11-211-1/+2
| | | | | We need this to be able to re-set it, as ipaUniqueID cannot be arbitraily set to a value. Only needed for the domain object.
* Fix typo in v3 base schemaSumit Bose2011-09-211-3/+3
|
* schema: Add new attributes and objectclasses for AD TrustsSimo Sorce2011-09-201-2/+13
|
* v3-schema: Add new ipaExternalGroup objectclassSimo Sorce2011-08-261-0/+8
This construct allows to have a group of ipaExternalMember attributes, that can be nested in a normal ipa Group ('memberOf' is allowed). It cannot contain normal ipa users/groups and cannot be nested with another group of the same type ('member' is not allowed).
generated by cgit (git 2.34.1) at 2024-09-29 02:26:11 +0000