diff options
| author | Petr Viktorin <pviktori@redhat.com> | 2014-03-26 17:11:23 +0100 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2014-04-16 16:10:43 +0200 |
| commit | 5c8548a4ad27fadcf58e4c414eafbc3c5e888450 (patch) | |
| tree | e60f22d874cfc1914e93f61afa1802fc2b6631ee | |
| parent | b53f2d28fdc64a99c16b6e9434911da0058c9f58 (diff) | |
| download | freeipa-5c8548a4ad27fadcf58e4c414eafbc3c5e888450.tar.gz freeipa-5c8548a4ad27fadcf58e4c414eafbc3c5e888450.tar.xz freeipa-5c8548a4ad27fadcf58e4c414eafbc3c5e888450.zip | |
Allow anonymous read access to Kerberos containers
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
Reviewed-By: Martin Kosek <mkosek@redhat.com>
| -rw-r--r-- | install/updates/20-aci.update | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/install/updates/20-aci.update b/install/updates/20-aci.update index e9e1fe9db..9d8a6392f 100644 --- a/install/updates/20-aci.update +++ b/install/updates/20-aci.update @@ -24,3 +24,7 @@ add:aci:'(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || # Read access to containers dn: $SUFFIX add:aci:'(targetfilter="(objectclass=nsContainer)")(target!="ldap:///cn=etc,$SUFFIX")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)' + +# Read access to Kerberos container (cn=kerberos) and realm containers (cn=$REALM,cn=kerberos) +dn: cn=kerberos,$SUFFIX +add:aci:'(targetattr = "cn || objectclass")(targetfilter = "(|(objectclass=krbrealmcontainer)(objectclass=krbcontainer))")(version 3.0;acl "Anonymous read access to Kerberos containers";allow (read,compare,search) userdn = "ldap:///anyone";)' |