From 7e803aa4625869ef6a8e78a09cd99270c4cc77e5 Mon Sep 17 00:00:00 2001 From: Martin Babinsky Date: Fri, 24 Jun 2016 17:02:25 +0200 Subject: replace an ACI relying on presence of deprecated objectclass Reviewed-By: David Kupka Reviewed-By: Jan Cholasta --- install/updates/20-aci.update | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/install/updates/20-aci.update b/install/updates/20-aci.update index 6cadef416..e9c10f54a 100644 --- a/install/updates/20-aci.update +++ b/install/updates/20-aci.update @@ -120,7 +120,8 @@ add:aci:(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can # Hosts can add their own services dn: cn=services,cn=accounts,$SUFFIX -add:aci: (target = "ldap:///krbprincipalname=*/($$dn)@$REALM,cn=services,cn=accounts,$SUFFIX")(targetfilter = "(objectClass=ipaKrbPrincipal)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($$dn),cn=computers,cn=accounts,$SUFFIX";) +remove:aci: (target = "ldap:///krbprincipalname=*/($$dn)@$REALM,cn=services,cn=accounts,$SUFFIX")(targetfilter = "(objectClass=ipaKrbPrincipal)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($$dn),cn=computers,cn=accounts,$SUFFIX";) +add:aci: (target = "ldap:///krbprincipalname=*/($$dn)@$REALM,cn=services,cn=accounts,$SUFFIX")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($$dn),cn=computers,cn=accounts,$SUFFIX";) # CIFS service on the master can manage ID ranges dn: cn=ranges,cn=etc,$SUFFIX -- cgit