diff options
| author | Martin Kosek <mkosek@redhat.com> | 2015-01-19 12:42:11 +0100 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2015-01-20 16:52:53 +0100 |
| commit | 251c97cf96edccaec5ce034007068609ad69227f (patch) | |
| tree | 3bae802aae7fe2195d1801856490e516ca598b4e /install | |
| parent | 82ab0eabf8b963023611ceb42f87244f40651c05 (diff) | |
| download | freeipa-251c97cf96edccaec5ce034007068609ad69227f.tar.gz freeipa-251c97cf96edccaec5ce034007068609ad69227f.tar.xz freeipa-251c97cf96edccaec5ce034007068609ad69227f.zip | |
Replication Administrators cannot remove replication agreements
Replication agreement deletion requires read access to DNA range
setting. The read access was accidently removed during PermissionV2
refactoring.
Add the read ACI back as a special SYSTEM permission.
https://fedorahosted.org/freeipa/ticket/4848
Reviewed-By: Martin Basti <mbasti@redhat.com>
Diffstat (limited to 'install')
| -rw-r--r-- | install/updates/40-replication.update | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/install/updates/40-replication.update b/install/updates/40-replication.update index 619d14663..f46ab19f0 100644 --- a/install/updates/40-replication.update +++ b/install/updates/40-replication.update @@ -14,3 +14,14 @@ default:member: cn=Replication Administrators,cn=privileges,cn=pbac,$SUFFIX dn: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config add:aci: '(targetattr=dnaNextRange || dnaNextValue || dnaMaxValue)(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,$SUFFIX";)' + +dn: cn=Read DNA Range,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: top +default:objectClass: groupofnames +default:objectClass: ipapermission +default:cn: Read DNA Range +default:ipapermissiontype: SYSTEM +default:member: cn=Replication Administrators,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config +add:aci: '(targetattr=cn || dnaMaxValue || dnaNextRange || dnaNextValue || dnaThreshold || dnaType || objectclass)(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,$SUFFIX";)' |