diff options
| author | Martin Kosek <mkosek@redhat.com> | 2015-01-20 17:57:07 +0100 |
|---|---|---|
| committer | Jan Cholasta <jcholast@redhat.com> | 2015-01-21 07:47:22 +0000 |
| commit | 0a7a8d66040f7a5f0e55da4b01e614dd9b569a00 (patch) | |
| tree | 009680708f9273b9ed5cb0a72e2cfa1c64d156b3 | |
| parent | af1f87a0346653532deeb04dc7f236d143c8b9a7 (diff) | |
| download | freeipa-0a7a8d66040f7a5f0e55da4b01e614dd9b569a00.tar.gz freeipa-0a7a8d66040f7a5f0e55da4b01e614dd9b569a00.tar.xz freeipa-0a7a8d66040f7a5f0e55da4b01e614dd9b569a00.zip | |
Add anonymous read ACI for DUA profile
DUA profile(s) are consumed by Solaris clients.
https://fedorahosted.org/freeipa/ticket/4850
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
| -rw-r--r-- | ACI.txt | 2 | ||||
| -rw-r--r-- | ipaserver/install/plugins/update_managed_permissions.py | 20 |
2 files changed, 22 insertions, 0 deletions
@@ -300,6 +300,8 @@ dn: cn=certificates,cn=ipa,cn=etc,dc=ipa,dc=example aci: (targetattr = "cacertificate || cn || createtimestamp || entryusn || ipacertissuerserial || ipacertsubject || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage || ipapublickey || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Read Certificate Store Entries";allow (compare,read,search) userdn = "ldap:///anyone";) dn: cn=dna,cn=ipa,cn=etc,dc=ipa,dc=example aci: (targetattr = "cn || createtimestamp || dnahostname || dnaportnum || dnaremainingvalues || dnaremotebindmethod || dnaremoteconnprotocol || dnasecureportnum || entryusn || modifytimestamp || objectclass")(targetfilter = "(objectclass=dnasharedconfig)")(version 3.0;acl "permission:System: Read DNA Configuration";allow (compare,read,search) userdn = "ldap:///all";) +dn: ou=profile,dc=ipa,dc=example +aci: (targetattr = "attributemap || authenticationmethod || bindtimelimit || cn || createtimestamp || credentiallevel || defaultsearchbase || defaultsearchscope || defaultserverlist || dereferencealiases || entryusn || followreferrals || modifytimestamp || objectclass || objectclassmap || ou || preferredserverlist || profilettl || searchtimelimit || serviceauthenticationmethod || servicecredentiallevel || servicesearchdescriptor")(targetfilter = "(|(objectclass=organizationalUnit)(objectclass=DUAConfigProfile))")(version 3.0;acl "permission:System: Read DUA Profile";allow (compare,read,search) userdn = "ldap:///anyone";) dn: cn=masters,cn=ipa,cn=etc,dc=ipa,dc=example aci: (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=config diff --git a/ipaserver/install/plugins/update_managed_permissions.py b/ipaserver/install/plugins/update_managed_permissions.py index 032485aac..430a2919a 100644 --- a/ipaserver/install/plugins/update_managed_permissions.py +++ b/ipaserver/install/plugins/update_managed_permissions.py @@ -320,6 +320,26 @@ NONOBJECT_PERMISSIONS = { 'winsyncsubtreepair', }, 'default_privileges': {'Replication Administrators'}, + }, + 'System: Read DUA Profile': { + 'ipapermlocation': DN('ou=profile', api.env.basedn), + 'ipapermtargetfilter': { + '(|' + '(objectclass=organizationalUnit)' + '(objectclass=DUAConfigProfile)' + ')' + }, + 'ipapermbindruletype': 'anonymous', + 'ipapermright': {'read', 'search', 'compare'}, + 'ipapermdefaultattr': { + 'objectclass', 'ou', 'cn', 'defaultServerList', + 'preferredServerList', 'defaultSearchBase', 'defaultSearchScope', + 'searchTimeLimit', 'bindTimeLimit', 'credentialLevel', + 'authenticationMethod', 'followReferrals', 'dereferenceAliases', + 'serviceSearchDescriptor', 'serviceCredentialLevel', + 'serviceAuthenticationMethod', 'objectclassMap', 'attributeMap', + 'profileTTL' + }, } } |