diff options
| author | root <root@vm-205.idm.lab.eng.brq.redhat.com> | 2015-06-19 17:27:11 +0200 |
|---|---|---|
| committer | Tomas Babej <tbabej@redhat.com> | 2015-06-29 13:50:04 +0200 |
| commit | ffd6b039a755016c3de22a11fec037eca7180a79 (patch) | |
| tree | 6e5759cd3f6146c72b8d69b74822e59cdab7c2d2 /ACI.txt | |
| parent | e3d3938f44a2444e18620b43b5734a8f27bb2c8b (diff) | |
| download | freeipa-ffd6b039a755016c3de22a11fec037eca7180a79.tar.gz freeipa-ffd6b039a755016c3de22a11fec037eca7180a79.tar.xz freeipa-ffd6b039a755016c3de22a11fec037eca7180a79.zip | |
User life cycle: permission to delete a preserved user
Add permission to delete an entry from Delete container
https://fedorahosted.org/freeipa/ticket/3813
Reviewed-By: Martin Basti <mbasti@redhat.com>
Diffstat (limited to 'ACI.txt')
| -rw-r--r-- | ACI.txt | 2 |
1 files changed, 2 insertions, 0 deletions
@@ -265,6 +265,8 @@ aci: (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=p dn: cn=staged users,cn=accounts,cn=provisioning,dc=ipa,dc=example aci: (targetattr = "*")(target = "ldap:///uid=*,cn=staged users,cn=accounts,cn=provisioning,dc=ipa,dc=example")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove Stage User";allow (delete) groupdn = "ldap:///cn=System: Remove Stage User,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example +aci: (targetattr = "*")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example")(targetfilter = "(objectclass=*)")(version 3.0;acl "permission:System: Remove preserved User";allow (delete) groupdn = "ldap:///cn=System: Remove preserved User,cn=permissions,cn=pbac,dc=ipa,dc=example";) +dn: cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example aci: (targetattr = "krblastpwdchange || krbpasswordexpiration || krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Reset Preserved User password";allow (read,search,write) groupdn = "ldap:///cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: dc=ipa,dc=example aci: (target_to = "ldap:///cn=users,cn=accounts,dc=ipa,dc=example")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=ipa,dc=example";) |