IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-28 01:41:14 -06:00
Code Issues Packages Projects Releases Wiki Activity
0b1fe08f1d
freeipa/install/updates/45-roles.update

94 lines
3.4 KiB
Plaintext
Raw Normal View History

Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles as examples. In doing so I realized that we were completely missing default rules for HBAC, SUDO and password policy so I added those as well. I ran into a problem when the updater has a default record and an add at the same time, it should handle it better now. ticket 585
2011-02-22 08:21:14 -06:00
# Helpdesk roles
dn: cn=Modify Users and Reset passwords,cn=privileges,cn=pbac,$SUFFIX
default:objectClass: top
default:objectClass: groupofnames
default:objectClass: nestedgroup
default:cn: Modify Users and Reset passwords
default:description: Modify Users and Reset passwords
default:member: cn=helpdesk,cn=roles,cn=accounts,$SUFFIX
dn: cn=Modify Group membership,cn=privileges,cn=pbac,$SUFFIX
default:objectClass: top
default:objectClass: groupofnames
default:objectClass: nestedgroup
default:cn: Modify Group membership
default:description: Modify Group membership
default:member: cn=helpdesk,cn=roles,cn=accounts,$SUFFIX
dn: cn=User Administrator,cn=roles,cn=accounts,$SUFFIX
default:objectClass: groupofnames
default:objectClass: nestedgroup
default:objectClass: top
default:cn: User Administrator
default:description: Responsible for creating Users and Groups
dn: cn=User Administrators,cn=privileges,cn=pbac,$SUFFIX
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add: member: cn=User Administrator,cn=roles,cn=accounts,$SUFFIX
Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles as examples. In doing so I realized that we were completely missing default rules for HBAC, SUDO and password policy so I added those as well. I ran into a problem when the updater has a default record and an add at the same time, it should handle it better now. ticket 585
2011-02-22 08:21:14 -06:00
dn: cn=Group Administrators,cn=privileges,cn=pbac,$SUFFIX
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add: member: cn=User Administrator,cn=roles,cn=accounts,$SUFFIX
User life cycle: Stage user Administrators permission/priviledge Creation of stage user administrator https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-05-08 03:41:44 -05:00
dn: cn=Stage User Administrators,cn=privileges,cn=pbac,$SUFFIX
ULC: fix: upgrade for stage Stage User Admins failed Upgrade failed because entry 'dn: cn=Stage User Administrators,cn=privileges,cn=pbac,$SUFFIX' doesnt exist. Now upgrade will create the privilege if it does not exist. https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-05-22 10:43:54 -05:00
default:objectClass: groupofnames
default:objectClass: nestedgroup
default:objectClass: top
default:cn: Stage User Administrators
default:description: Stage User Administrators
User life cycle: Stage user Administrators permission/priviledge Creation of stage user administrator https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-05-08 03:41:44 -05:00
add: member: cn=User Administrator,cn=roles,cn=accounts,$SUFFIX
Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles as examples. In doing so I realized that we were completely missing default rules for HBAC, SUDO and password policy so I added those as well. I ran into a problem when the updater has a default record and an add at the same time, it should handle it better now. ticket 585
2011-02-22 08:21:14 -06:00
dn: cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX
default:objectClass: groupofnames
default:objectClass: nestedgroup
default:objectClass: top
default:cn: IT Specialist
default:description: IT Specialist
dn: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add:member: cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX
Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles as examples. In doing so I realized that we were completely missing default rules for HBAC, SUDO and password policy so I added those as well. I ran into a problem when the updater has a default record and an add at the same time, it should handle it better now. ticket 585
2011-02-22 08:21:14 -06:00
dn: cn=Host Group Administrators,cn=privileges,cn=pbac,$SUFFIX
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add:member: cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX
Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles as examples. In doing so I realized that we were completely missing default rules for HBAC, SUDO and password policy so I added those as well. I ran into a problem when the updater has a default record and an add at the same time, it should handle it better now. ticket 585
2011-02-22 08:21:14 -06:00
dn: cn=Service Administrators,cn=privileges,cn=pbac,$SUFFIX
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add:member: cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX
Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles as examples. In doing so I realized that we were completely missing default rules for HBAC, SUDO and password policy so I added those as well. I ran into a problem when the updater has a default record and an add at the same time, it should handle it better now. ticket 585
2011-02-22 08:21:14 -06:00
dn: cn=Automount Administrators,cn=privileges,cn=pbac,$SUFFIX
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add:member: cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX
Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles as examples. In doing so I realized that we were completely missing default rules for HBAC, SUDO and password policy so I added those as well. I ran into a problem when the updater has a default record and an add at the same time, it should handle it better now. ticket 585
2011-02-22 08:21:14 -06:00
dn: cn=IT Security Specialist,cn=roles,cn=accounts,$SUFFIX
default:objectClass: groupofnames
default:objectClass: nestedgroup
default:objectClass: top
default:cn: IT Security Specialist
default:description: IT Security Specialist
dn: cn=Netgroups Administrators,cn=privileges,cn=pbac,$SUFFIX
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add:member: cn=IT Security Specialist,cn=roles,cn=accounts,$SUFFIX
Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles as examples. In doing so I realized that we were completely missing default rules for HBAC, SUDO and password policy so I added those as well. I ran into a problem when the updater has a default record and an add at the same time, it should handle it better now. ticket 585
2011-02-22 08:21:14 -06:00
dn: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add:member: cn=IT Security Specialist,cn=roles,cn=accounts,$SUFFIX
Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles as examples. In doing so I realized that we were completely missing default rules for HBAC, SUDO and password policy so I added those as well. I ran into a problem when the updater has a default record and an add at the same time, it should handle it better now. ticket 585
2011-02-22 08:21:14 -06:00
Use Sudo rather than SUDO as a label. ticket 1005
2011-02-28 10:44:27 -06:00
dn: cn=Sudo administrator,cn=privileges,cn=pbac,$SUFFIX
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add:member: cn=IT Security Specialist,cn=roles,cn=accounts,$SUFFIX
Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles as examples. In doing so I realized that we were completely missing default rules for HBAC, SUDO and password policy so I added those as well. I ran into a problem when the updater has a default record and an add at the same time, it should handle it better now. ticket 585
2011-02-22 08:21:14 -06:00
dn: cn=Security Architect,cn=roles,cn=accounts,$SUFFIX
default:objectClass: groupofnames
default:objectClass: nestedgroup
default:objectClass: top
default:cn: Security Architect
default:description: Security Architect
dn: cn=Delegation Administrator,cn=privileges,cn=pbac,$SUFFIX
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add:member: cn=Security Architect,cn=roles,cn=accounts,$SUFFIX
Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles as examples. In doing so I realized that we were completely missing default rules for HBAC, SUDO and password policy so I added those as well. I ran into a problem when the updater has a default record and an add at the same time, it should handle it better now. ticket 585
2011-02-22 08:21:14 -06:00
dn: cn=Replication Administrators,cn=privileges,cn=pbac,$SUFFIX
aci: allow members of ipaservers to set up replication Add ACIs which allow the members of the ipaservers host group to set up replication. This allows IPA hosts to perform replica promotion on themselves. A number of checks which need read access to certain LDAP entries is done during replica promotion. Add ACIs to allow these checks to be done using any valid IPA host credentials. https://fedorahosted.org/freeipa/ticket/5401 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-11-13 01:15:55 -06:00
add:member: cn=ipaservers,cn=hostgroups,cn=accounts,$SUFFIX
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add:member: cn=Security Architect,cn=roles,cn=accounts,$SUFFIX
Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles as examples. In doing so I realized that we were completely missing default rules for HBAC, SUDO and password policy so I added those as well. I ran into a problem when the updater has a default record and an add at the same time, it should handle it better now. ticket 585
2011-02-22 08:21:14 -06:00
dn: cn=Write IPA Configuration,cn=privileges,cn=pbac,$SUFFIX
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add:member: cn=Security Architect,cn=roles,cn=accounts,$SUFFIX
Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles as examples. In doing so I realized that we were completely missing default rules for HBAC, SUDO and password policy so I added those as well. I ran into a problem when the updater has a default record and an add at the same time, it should handle it better now. ticket 585
2011-02-22 08:21:14 -06:00
dn: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add:member: cn=Security Architect,cn=roles,cn=accounts,$SUFFIX
Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles as examples. In doing so I realized that we were completely missing default rules for HBAC, SUDO and password policy so I added those as well. I ran into a problem when the updater has a default record and an add at the same time, it should handle it better now. ticket 585
2011-02-22 08:21:14 -06:00
Reference in New Issue Copy Permalink