From a735420a9ba3d507855a75a1a48f79a2358c7081 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Thu, 22 Mar 2012 17:19:01 -0400 Subject: Set nsslapd-minssf-exclude-rootdse to on so the DSE is always available. If minssf is set in configuration and this is not set then clients won't be able to detect the available namingContexts, defaultNamingContext, capabilities, etc. https://fedorahosted.org/freeipa/ticket/2542 --- ipaserver/ipaldap.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'ipaserver/ipaldap.py') diff --git a/ipaserver/ipaldap.py b/ipaserver/ipaldap.py index 8703b5e4..7174072a 100644 --- a/ipaserver/ipaldap.py +++ b/ipaserver/ipaldap.py @@ -540,7 +540,7 @@ class IPAdmin(IPAEntryLDAPObject): # Some attributes, like those in cn=config, need to be replaced # not deleted/added. - FORCE_REPLACE_ON_UPDATE_ATTRS = ('nsslapd-ssl-check-hostname', 'nsslapd-lookthroughlimit', 'nsslapd-idlistscanlimit', 'nsslapd-anonlimitsdn') + FORCE_REPLACE_ON_UPDATE_ATTRS = ('nsslapd-ssl-check-hostname', 'nsslapd-lookthroughlimit', 'nsslapd-idlistscanlimit', 'nsslapd-anonlimitsdn', 'nsslapd-minssf-exclude-rootdse') modlist = [] old_entry = ipautil.CIDict(old_entry) -- cgit