IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-28 01:41:14 -06:00
Code Issues Packages Projects Releases Wiki Activity
0b1fe08f1d
freeipa/install/updates/40-otp.update

62 lines
4.6 KiB
Plaintext
Raw Normal View History

Add IPA OTP schema and ACLs This commit adds schema support for two factor authentication via OTP devices, including RADIUS or TOTP. This schema will be used by future patches which will enable two factor authentication directly. https://fedorahosted.org/freeipa/ticket/3365 http://freeipa.org/page/V3/OTP
2013-04-11 12:24:46 -05:00
dn: cn=otp,$SUFFIX
default: objectClass: nsContainer
default: objectClass: top
default: cn: otp
Make token auth and sync windows configurable This introduces two new CLI commands: * otpconfig-show * otpconfig-mod https://fedorahosted.org/freeipa/ticket/4511 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-11-11 13:41:42 -06:00
dn: cn=otp,cn=etc,$SUFFIX
default: objectClass: ipatokenOTPConfig
default: objectClass: top
default: cn: otp
default: ipatokenTOTPauthWindow: 300
default: ipatokenTOTPsyncWindow: 86400
default: ipatokenHOTPauthWindow: 10
default: ipatokenHOTPsyncWindow: 100
Add IPA OTP schema and ACLs This commit adds schema support for two factor authentication via OTP devices, including RADIUS or TOTP. This schema will be used by future patches which will enable two factor authentication directly. https://fedorahosted.org/freeipa/ticket/3365 http://freeipa.org/page/V3/OTP
2013-04-11 12:24:46 -05:00
dn: $SUFFIX
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
remove: aci:(target = "ldap:///ipatokenuniqueid=*,cn=otp,$SUFFIX")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create and delete tokens"; allow (add, delete) userattr = "ipatokenOwner#SELFDN";)
remove: aci:(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || ipatokenUniqueID || description || ipatokenOwner || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Users can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN";)
remove: aci:(targetfilter = "(objectClass=ipaToken)")(targetattrs = "ipatokenUniqueID || description || ipatokenOwner || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Users can write basic token info"; allow (write) userattr = "ipatokenOwner#USERDN";)
remove: aci:(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPkey || ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPclockOffset || ipatokenTOTPtimeStep")(version 3.0; acl "Users can add TOTP token secrets"; allow (write, search) userattr = "ipatokenOwner#USERDN";)
remove: aci:(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPkey || ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenHOTPcounter")(version 3.0; acl "Users can add HOTP token secrets"; allow (write, search) userattr = "ipatokenOwner#USERDN";)
add: aci:(targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)
add: aci:(targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)
add: aci:(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)
add: aci:(targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)
add: aci:(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)
add: aci:(target = "ldap:///ipatokenuniqueid=*,cn=otp,$SUFFIX")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)
Add RADIUS proxy support to ipalib CLI https://fedorahosted.org/freeipa/ticket/3368
2013-11-11 15:58:02 -06:00
dn: cn=radiusproxy,$SUFFIX
default: objectClass: nsContainer
default: objectClass: top
default: cn: radiusproxy
Create ipa-otp-counter 389DS plugin This plugin ensures that all counter/watermark operations are atomic and never decrement. Also, deletion is not permitted. Because this plugin also ensures internal operations behave properly, this also gives ipa-pwd-extop the appropriate behavior for OTP authentication. https://fedorahosted.org/freeipa/ticket/4493 https://fedorahosted.org/freeipa/ticket/4494 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-09-10 16:31:37 -05:00
Configure IPA OTP Last Token plugin on upgrade Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-17 12:02:58 -05:00
dn: cn=IPA OTP Last Token,cn=plugins,cn=config
default:objectclass: top
default:objectclass: nsSlapdPlugin
default:objectclass: extensibleObject
default:cn: IPA OTP Last Token
default:nsslapd-pluginpath: libipa_otp_lasttoken
default:nsslapd-plugininitfunc: ipa_otp_lasttoken_init
default:nsslapd-plugintype: preoperation
default:nsslapd-pluginenabled: on
default:nsslapd-pluginid: ipa-otp-lasttoken
default:nsslapd-pluginversion: 1.0
default:nsslapd-pluginvendor: Red Hat, Inc.
default:nsslapd-plugindescription: IPA OTP Last Token plugin
default:nsslapd-plugin-depends-on-type: database
Create ipa-otp-counter 389DS plugin This plugin ensures that all counter/watermark operations are atomic and never decrement. Also, deletion is not permitted. Because this plugin also ensures internal operations behave properly, this also gives ipa-pwd-extop the appropriate behavior for OTP authentication. https://fedorahosted.org/freeipa/ticket/4493 https://fedorahosted.org/freeipa/ticket/4494 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-09-10 16:31:37 -05:00
dn: cn=IPA OTP Counter,cn=plugins,cn=config
default:objectclass: top
default:objectclass: nsSlapdPlugin
default:objectclass: extensibleObject
default:cn: IPA OTP Counter
default:nsslapd-pluginpath: libipa_otp_counter
default:nsslapd-plugininitfunc: ipa_otp_counter_init
default:nsslapd-plugintype: preoperation
default:nsslapd-pluginenabled: on
default:nsslapd-pluginid: ipa-otp-counter
default:nsslapd-pluginversion: 1.0
default:nsslapd-pluginvendor: Red Hat, Inc.
default:nsslapd-plugindescription: IPA OTP Counter plugin
default:nsslapd-plugin-depends-on-type: database
Reference in New Issue Copy Permalink