diff options
| author | Noriko Hosoi <nhosoi@redhat.com> | 2010-10-13 11:23:49 -0700 |
|---|---|---|
| committer | Noriko Hosoi <nhosoi@redhat.com> | 2010-10-13 11:23:49 -0700 |
| commit | e6c0ce5d97a78689722fe3c627f7a99cf81f6b77 (patch) | |
| tree | cb92bea520439a8df4076dcfc494d7e0bc3419e8 /ldap/servers/slapd/slap.h | |
| parent | c5cd4dd3baf47d6f3f11d23c2bf4d1a6300da863 (diff) | |
| download | ds-e6c0ce5d97a78689722fe3c627f7a99cf81f6b77.tar.gz ds-e6c0ce5d97a78689722fe3c627f7a99cf81f6b77.tar.xz ds-e6c0ce5d97a78689722fe3c627f7a99cf81f6b77.zip | |
Bug 602456 - Allow to add any cn=config attributes;389-ds-base-1.2.7.a1
allow to delete some cn=config attributes
https://bugzilla.redhat.com/show_bug.cgi?id=602456
Description:
1. Originally, configuration attributes are designed not to allow
adding or deleting, but to allow just replacing. Due to a defect
in checking the add operation, adding (LDAP_MOD_ADD) is not rejected.
Instead of fixing the add checking to disallow adding, this patch
logs the operation in the error log.
2. On the other hand, deleting configuration attributes is rejected
by LDAP_UNWILLING_TO_PERFORM. We have a request that some attributes
need to allow to delete. This patch introduces a config attribute
nsslapd-allowed-to-delete-attrs, which value is configuration
attributes separated by a space ' '. If an attribute is in the list,
the attribute is allowed to delete. The delete operation is also
logged in the error log. By default, the list contains "nsslapd-
listenhost" and "nsslapd-securelistenhost".
Diffstat (limited to 'ldap/servers/slapd/slap.h')
| -rw-r--r-- | ldap/servers/slapd/slap.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index 1f4afd91..cac60eb2 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -1906,6 +1906,7 @@ typedef struct _slapdEntryPoints { #define CONFIG_OUTBOUND_LDAP_IO_TIMEOUT_ATTRIBUTE "nsslapd-outbound-ldap-io-timeout" #define CONFIG_FORCE_SASL_EXTERNAL_ATTRIBUTE "nsslapd-force-sasl-external" #define CONFIG_ENTRYUSN_GLOBAL "nsslapd-entryusn-global" +#define CONFIG_ALLOWED_TO_DELETE_ATTRIBUTE "nsslapd-allowed-to-delete-attrs" #ifdef MEMPOOL_EXPERIMENTAL #define CONFIG_MEMPOOL_SWITCH_ATTRIBUTE "nsslapd-mempool" @@ -2123,6 +2124,7 @@ typedef struct _slapdFrontendConfig { #endif /* MEMPOOL_EXPERIMENTAL */ int force_sasl_external; /* force SIMPLE bind to be SASL/EXTERNAL if client cert credentials were supplied */ int entryusn_global; /* Entry USN: Use global counter */ + char **allowed_to_delete_attrs;/* charray of config attrs allowed to delete */ } slapdFrontendConfig_t; /* possible values for slapdFrontendConfig_t.schemareplace */ |