DUA profile(s) are consumed by Solaris clients. https://fedorahosted.org/freeipa/ticket/4850
-- Martin Kosek <mko...@redhat.com> Supervisor, Software Engineering - Identity Management Team Red Hat Inc.
From 19b460c4154becd801f71d14b84c8ad72033c6db Mon Sep 17 00:00:00 2001 From: Martin Kosek <mko...@redhat.com> Date: Tue, 20 Jan 2015 17:57:07 +0100 Subject: [PATCH] Add anonymous read ACI for DUA profile DUA profile(s) are consumed by Solaris clients. https://fedorahosted.org/freeipa/ticket/4850 --- ACI.txt | 2 ++ .../install/plugins/update_managed_permissions.py | 19 +++++++++++++++++++ 2 files changed, 21 insertions(+) diff --git a/ACI.txt b/ACI.txt index fdef43e63595d6b5b38237991ff4fcdaa8225666..daa4652e157ab8531117fb047e2c80ba046b117f 100644 --- a/ACI.txt +++ b/ACI.txt @@ -300,6 +300,8 @@ dn: cn=certificates,cn=ipa,cn=etc,dc=ipa,dc=example aci: (targetattr = "cacertificate || cn || createtimestamp || entryusn || ipacertissuerserial || ipacertsubject || ipaconfigstring || ipakeyextusage || ipakeytrust || ipakeyusage || ipapublickey || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipacertificate)")(version 3.0;acl "permission:System: Read Certificate Store Entries";allow (compare,read,search) userdn = "ldap:///anyone";;) dn: cn=dna,cn=ipa,cn=etc,dc=ipa,dc=example aci: (targetattr = "cn || createtimestamp || dnahostname || dnaportnum || dnaremainingvalues || dnaremotebindmethod || dnaremoteconnprotocol || dnasecureportnum || entryusn || modifytimestamp || objectclass")(targetfilter = "(objectclass=dnasharedconfig)")(version 3.0;acl "permission:System: Read DNA Configuration";allow (compare,read,search) userdn = "ldap:///all";;) +dn: ou=profile,dc=ipa,dc=example +aci: (targetattr = "attributemap || authenticationmethod || bindtimelimit || credentiallevel || defaultsearchbase || defaultsearchscope || defaultserverlist || dereferencealiases || followreferrals || objectclassmap || ou || preferredserverlist || profilettl || searchtimelimit || serviceauthenticationmethod || servicecredentiallevel || servicesearchdescriptor")(targetfilter = "(|(objectclass=organizationalUnit)(objectclass=DUAConfigProfile))")(version 3.0;acl "permission:System: Read DUA Profile";allow (compare,read,search) userdn = "ldap:///anyone";;) dn: cn=masters,cn=ipa,cn=etc,dc=ipa,dc=example aci: (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=nscontainer)")(version 3.0;acl "permission:System: Read IPA Masters";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Masters,cn=permissions,cn=pbac,dc=ipa,dc=example";) dn: cn=config diff --git a/ipaserver/install/plugins/update_managed_permissions.py b/ipaserver/install/plugins/update_managed_permissions.py index 032485aac5b84b12b91464f16870c9940b18bc2d..a34ba08cb0ab719c91b19830f5b5e3124ef9d742 100644 --- a/ipaserver/install/plugins/update_managed_permissions.py +++ b/ipaserver/install/plugins/update_managed_permissions.py @@ -320,6 +320,25 @@ 'winsyncsubtreepair', }, 'default_privileges': {'Replication Administrators'}, + }, + 'System: Read DUA Profile': { + 'ipapermlocation': DN('ou=profile', api.env.basedn), + 'ipapermtargetfilter': { + '(|' + '(objectclass=organizationalUnit)' + '(objectclass=DUAConfigProfile)' + ')' + }, + 'ipapermbindruletype': 'anonymous', + 'ipapermright': {'read', 'search', 'compare'}, + 'ipapermdefaultattr': { + 'objectclass', 'ou', 'defaultServerList', 'preferredServerList', + 'defaultSearchBase', 'defaultSearchScope', 'searchTimeLimit', + 'bindTimeLimit', 'credentialLevel', 'authenticationMethod', + 'followReferrals', 'dereferenceAliases', 'serviceSearchDescriptor', + 'serviceCredentialLevel', 'serviceAuthenticationMethod', + 'objectclassMap', 'attributeMap', 'profileTTL' + }, } } -- 1.9.3
_______________________________________________ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
