diff options
| author | Rob Crittenden <rcritten@redhat.com> | 2013-03-01 15:02:14 -0500 |
|---|---|---|
| committer | Rob Crittenden <rcritten@redhat.com> | 2013-03-13 10:32:36 -0400 |
| commit | 9005b9bc8aac7c1381aadb7d17107ebbebae005d (patch) | |
| tree | 15c0b3ce22d95e265130bf8fcb815bdf79e6b4dc /install/updates | |
| parent | 63407ed477035765dda38fbead1353d4f47ac26a (diff) | |
| download | freeipa-9005b9bc8aac7c1381aadb7d17107ebbebae005d.tar.gz freeipa-9005b9bc8aac7c1381aadb7d17107ebbebae005d.tar.xz freeipa-9005b9bc8aac7c1381aadb7d17107ebbebae005d.zip | |
Extend ipa-replica-manage to be able to manage DNA ranges.
Attempt to automatically save DNA ranges when a master is removed.
This is done by trying to find a master that does not yet define
a DNA on-deck range. If one can be found then the range on the deleted
master is added.
If one cannot be found then it is reported as an error.
Some validation of the ranges are done to ensure that they do overlap
an IPA local range and do not overlap existing DNA ranges configured
on other masters.
http://freeipa.org/page/V3/Recover_DNA_Ranges
https://fedorahosted.org/freeipa/ticket/3321
Diffstat (limited to 'install/updates')
| -rw-r--r-- | install/updates/40-replication.update | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/install/updates/40-replication.update b/install/updates/40-replication.update index f9e0496be..619d14663 100644 --- a/install/updates/40-replication.update +++ b/install/updates/40-replication.update @@ -2,3 +2,15 @@ # an agreement. dn: cn=userRoot,cn=ldbm database,cn=plugins,cn=config add:aci: '(targetattr=nsslapd-readonly)(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,$SUFFIX";)' + +# Add rules to manage DNA ranges +dn: cn=Modify DNA Range,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: top +default:objectClass: groupofnames +default:objectClass: ipapermission +default:cn: Modify DNA Range +default:ipapermissiontype: SYSTEM +default:member: cn=Replication Administrators,cn=privileges,cn=pbac,$SUFFIX + +dn: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config +add:aci: '(targetattr=dnaNextRange || dnaNextValue || dnaMaxValue)(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,$SUFFIX";)' |