From 4ded2ffc161ec649ba1ccf8d0b528d24028080df Mon Sep 17 00:00:00 2001 From: Nathaniel McCallum Date: Wed, 4 May 2016 17:08:45 -0400 Subject: Enable service authentication indicator management https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Petr Vobornik Reviewed-By: Alexander Bokovoy --- ipalib/plugins/service.py | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'ipalib/plugins') diff --git a/ipalib/plugins/service.py b/ipalib/plugins/service.py index 2d3476e83..ec2071b87 100644 --- a/ipalib/plugins/service.py +++ b/ipalib/plugins/service.py @@ -411,7 +411,7 @@ class service(LDAPObject): permission_filter_objectclasses = ['ipaservice'] search_attributes = ['krbprincipalname', 'managedby', 'ipakrbauthzdata'] default_attributes = ['krbprincipalname', 'usercertificate', 'managedby', - 'ipakrbauthzdata', 'memberof', 'ipaallowedtoperform'] + 'ipakrbauthzdata', 'memberof', 'ipaallowedtoperform', 'krbprincipalauthind'] uuid_attribute = 'ipauniqueid' attribute_members = { 'managedby': ['host'], @@ -505,6 +505,14 @@ class service(LDAPObject): " e.g. this might be necessary for NFS services."), values=(u'MS-PAC', u'PAD', u'NONE'), ), + Str('krbprincipalauthind*', + cli_name='auth_ind', + label=_('Authentication Indicators'), + doc=_("Defines a whitelist for Authentication Indicators." + " Use 'otp' to allow OTP-based 2FA authentications." + " Use 'radius' to allow RADIUS-based 2FA authentications." + " Other values may be used for custom configurations."), + ), ) + ticket_flags_params def validate_ipakrbauthzdata(self, entry): -- cgit