I have updated the gist using the PWM documentation I found to do just that. Let me know if that is more acceptable. I'm feeling my way through this, please pardon my lack of savoir-faire.
See latest at https://gist.github.com/PowerWagon/d794a1233d7943f1614d2ae5223e678a *Jason Elwell* *Office: 205-298-3731 * *Cell: 205-603-4195 * elwe...@vmcmail.com E-mail Confidentiality Footer Privileged/Confidential Information may be contained in this message. If you are not the addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such case, you should destroy this message, and notify the sender immediately. If you or your employer does not consent to e-mail messages of this kind, please advise the sender immediately. Opinions, conclusions and other information expressed in this message are not given or endorsed by employer unless otherwise indicated by an authorized representative independent of this message On Tue, Oct 25, 2016 at 9:01 AM, Simo Sorce <s...@redhat.com> wrote: > On Sun, 2016-10-23 at 12:22 -0500, Elwell, Jason wrote: > > I posted this on the PWM boards, and figured I'd send this along here, > > too. I'm looking for feedback on this. Let me know if you find this > > accurate and/or valuable. Thanks! > > > > > > PWM setup for FreeIPA > > https://gist.github.com/PowerWagon/d794a1233d7943f1614d2ae5223e678a > > > > PwmConfiguration-template.xml > > https://gist.github.com/PowerWagon/0e83a0c5b67316a6987944b76eb103bc > > Jason, > It seems to me your ACIs are too lax, you should also make the PWM user > a password synchronization agent and not just give it blanket access to > read everything from the directory and write every password, you should > limit it to users for example and not allow it to change service's or > host's "passwords". > > Simo. > > -- > Simo Sorce * Red Hat, Inc * New York > >
-- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project