From 1389567ec58dca310edf679af7903013f0bdaf07 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Wed, 16 Apr 2014 10:27:09 +0200 Subject: Extend anonymous read ACI for containers - Allow cn=etc,$SUFFIX with these exceptions: - cn=masters,cn=ipa,cn=etc,$SUFFIX - virtual operations - cn=replicas,cn=ipa,cn=etc,$SUFFIX - Disallow anonymous read access to Kerberos password policy Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek --- install/updates/20-aci.update | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'install/updates') diff --git a/install/updates/20-aci.update b/install/updates/20-aci.update index 9d8a6392f..d3a9db2ae 100644 --- a/install/updates/20-aci.update +++ b/install/updates/20-aci.update @@ -23,7 +23,10 @@ add:aci:'(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || # Read access to containers dn: $SUFFIX -add:aci:'(targetfilter="(objectclass=nsContainer)")(target!="ldap:///cn=etc,$SUFFIX")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)' +add:aci:'(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy))(!(objectclass=ipaVirtualOperation)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,$SUFFIX")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)' + +dn: cn=replicas,cn=ipa,cn=etc,$SUFFIX +add:aci:'(targetfilter="(objectclass=nsContainer)")(version 3.0; acl "Deny read access to replica configuration"; deny(read, search, compare) userdn = "ldap:///anyone";)' # Read access to Kerberos container (cn=kerberos) and realm containers (cn=$REALM,cn=kerberos) dn: cn=kerberos,$SUFFIX -- cgit