From ad6480f845e91479647a2a6d509565e59c4aa480 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 20 Feb 2014 12:18:16 +0200 Subject: schema-compat: set precedence to 49 to allow OTP binds over compat tree schema-compat plugin rewrites bind DN to point to the original entry on LDAP bind operation. To work with OTP tokens this requires that schema-compat's pre-bind callback is called before pre-bind callback of the ipa-pwd-extop plugin. Therefore, schema-compat plugin should have a nsslapd-pluginprecedence value lower than (default) 50 which is used by the ipa-pwd-extop plugin. Note that this will only work if ticket 47699 is fixed in 389-ds. Reviewed-By: Nathaniel McCallum --- install/updates/10-schema_compat.update | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'install/updates') diff --git a/install/updates/10-schema_compat.update b/install/updates/10-schema_compat.update index 1199ef386..505bfcaa8 100644 --- a/install/updates/10-schema_compat.update +++ b/install/updates/10-schema_compat.update @@ -23,3 +23,10 @@ default:schema-compat-entry-attribute: macAddress=%{macAddress} dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config add:schema-compat-entry-attribute: sudoOrder=%{sudoOrder} + +dn: cn=Schema Compatibility,cn=plugins,cn=config +# We need to run schema-compat pre-bind callback before +# other IPA pre-bind callbacks to make sure bind DN is +# rewritten to the original entry if needed +add:nsslapd-pluginprecedence: 49 + -- cgit