From 54080f46b02c04706021a6cd419f5b30d88d2b7b Mon Sep 17 00:00:00 2001 From: Jan Cholasta Date: Wed, 6 Mar 2013 10:07:13 +0100 Subject: Remove disabled entries from sudoers compat tree. The removal is triggered by generating an invalid RDN when ipaEnabledFlag of the original entry is FALSE. https://fedorahosted.org/freeipa/ticket/3437 --- install/share/schema_compat.uldif | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'install/share') diff --git a/install/share/schema_compat.uldif b/install/share/schema_compat.uldif index a93b3277..40b96116 100644 --- a/install/share/schema_compat.uldif +++ b/install/share/schema_compat.uldif @@ -70,7 +70,7 @@ add:cn: sudoers add:schema-compat-container-group: 'ou=SUDOers, $SUFFIX' add:schema-compat-search-base: 'cn=sudorules, cn=sudo, $SUFFIX' add:schema-compat-search-filter: (&(objectclass=ipaSudoRule)(!(compatVisible=FALSE))(!(ipaEnabledFlag=FALSE))) -add:schema-compat-entry-rdn: cn=%{cn} +add:schema-compat-entry-rdn: %ifeq("ipaEnabledFlag", "FALSE", "DISABLED", "cn=%{cn}") add:schema-compat-entry-attribute: objectclass=sudoRole add:schema-compat-entry-attribute: 'sudoUser=%ifeq("userCategory","all","ALL","%{externalUser}")' add:schema-compat-entry-attribute: 'sudoUser=%ifeq("userCategory","all","ALL","%deref_f(\"memberUser\",\"(objectclass=posixAccount)\",\"uid\")")' -- cgit