IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-26 00:41:25 -06:00
Code Issues Packages Projects Releases Wiki Activity
33c2740d82
freeipa/install/share/bootstrap-template.ldif

524 lines
11 KiB
Plaintext
Raw Normal View History

Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=accounts,$SUFFIX
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested!
2007-06-28 18:09:54 -05:00
changetype: add
import initial install tool
0000-12-31 18:09:24 -05:50
objectClass: top
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
objectClass: nsContainer
cn: accounts
import initial install tool
0000-12-31 18:09:24 -05:50
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=users,cn=accounts,$SUFFIX
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested!
2007-06-28 18:09:54 -05:00
changetype: add
import initial install tool
0000-12-31 18:09:24 -05:50
objectClass: top
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
objectClass: nsContainer
cn: users
import initial install tool
0000-12-31 18:09:24 -05:50
More DIT fixes discovered after testing
2007-08-31 17:36:54 -05:00
dn: cn=groups,cn=accounts,$SUFFIX
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested!
2007-06-28 18:09:54 -05:00
changetype: add
import initial install tool
0000-12-31 18:09:24 -05:50
objectClass: top
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
objectClass: nsContainer
cn: groups
import initial install tool
0000-12-31 18:09:24 -05:50
Add xml-rpc interface for getting keytabs. Warning: this lacks any sort of authorization.
0000-12-31 18:09:24 -05:50
dn: cn=services,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: services
import initial install tool
0000-12-31 18:09:24 -05:50
minor typos
2007-11-30 15:58:02 -06:00
dn: cn=computers,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: computers
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
dn: cn=hostgroups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: hostgroups
Add index and container for RFC 2307 IP services IPA doesn't officially support RFC 2307 IP services. However SSSD has a nsswitch plugin to provide service lookups. The subtree search for (&(ipserviceport=$PORT)(ipserviceprotocol=$SRV)(objectclass=ipservice)) in cn=accounts,$SUFFIX has caused performance issues on large installations. This patch introduced a dedicated container cn=ipservices,cn=accounts,$SUFFIX for IP services for future use or 3rd party extensions. SSSD will be change its search base in an upcoming release, too. A new ipServicePort index is added to optimize searches for an IP service by port. There is no index on ipServiceProtocol because the index would have poor selectivity. An ipService entry has either 'tcp' or 'udp' as protocol. Fixes: https://pagure.io/freeipa/issue/7797 See: https://pagure.io/freeipa/issue/7786 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-12-07 06:08:49 -06:00
dn: cn=ipservices,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: ipservices
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
dn: cn=alt,$SUFFIX
changetype: add
objectClass: nsContainer
cn: alt
dn: cn=ng,cn=alt,$SUFFIX
changetype: add
objectClass: nsContainer
cn: ng
dn: cn=automount,$SUFFIX
changetype: add
objectClass: nsContainer
cn: automount
dn: cn=default,cn=automount,$SUFFIX
changetype: add
objectClass: nsContainer
cn: default
dn: automountmapname=auto.master,cn=default,cn=automount,$SUFFIX
changetype: add
objectClass: automountMap
automountMapName: auto.master
dn: automountmapname=auto.direct,cn=default,cn=automount,$SUFFIX
changetype: add
objectClass: automountMap
automountMapName: auto.direct
Enforce uniqueness on (key,info) pairs in automount keys https://fedorahosted.org/freeipa/ticket/293
2010-12-19 13:23:16 -06:00
dn: description=/- auto.direct,automountmapname=auto.master,cn=default,cn=automount,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectClass: automount
automountKey: /-
automountInformation: auto.direct
Enforce uniqueness on (key,info) pairs in automount keys https://fedorahosted.org/freeipa/ticket/293
2010-12-19 13:23:16 -06:00
description: /- auto.direct
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=hbac,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: hbac
dn: cn=hbacservices,cn=hbac,$SUFFIX
Add groups of services to HBAC Replace serviceName with memberService so we can assign individual services or groups of services to an HBAC rule. 588574
2010-05-14 08:37:54 -05:00
changetype: add
objectClass: top
objectClass: nsContainer
cn: hbacservices
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=hbacservicegroups,cn=hbac,$SUFFIX
Add groups of services to HBAC Replace serviceName with memberService so we can assign individual services or groups of services to an HBAC rule. 588574
2010-05-14 08:37:54 -05:00
changetype: add
objectClass: top
objectClass: nsContainer
cn: hbacservicegroups
Move sudo related data all under cn=sudo Fixes: https://fedorahosted.org/freeipa/ticket/773
2011-01-14 14:27:56 -06:00
dn: cn=sudo,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: sudo
dn: cn=sudocmds,cn=sudo,$SUFFIX
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
changetype: add
objectClass: top
objectClass: nsContainer
cn: sudocmds
Move sudo related data all under cn=sudo Fixes: https://fedorahosted.org/freeipa/ticket/773
2011-01-14 14:27:56 -06:00
dn: cn=sudocmdgroups,cn=sudo,$SUFFIX
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
changetype: add
objectClass: top
objectClass: nsContainer
cn: sudocmdgroups
Move sudo related data all under cn=sudo Fixes: https://fedorahosted.org/freeipa/ticket/773
2011-01-14 14:27:56 -06:00
dn: cn=sudorules,cn=sudo,$SUFFIX
Add HBAC plugin and introduce GeneralizedTime parameter type.
2009-09-30 09:24:25 -05:00
changetype: add
objectClass: top
objectClass: nsContainer
Move sudo related data all under cn=sudo Fixes: https://fedorahosted.org/freeipa/ticket/773
2011-01-14 14:27:56 -06:00
cn: sudorules
Add HBAC plugin and introduce GeneralizedTime parameter type.
2009-09-30 09:24:25 -05:00
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=etc,$SUFFIX
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
changetype: add
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
objectClass: nsContainer
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
objectClass: top
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
cn: etc
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
DNS Locations: location-* commands http://www.freeipa.org/page/V4/DNS_Location_Mechanism https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-05-12 03:54:20 -05:00
dn: cn=locations,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: locations
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=sysaccounts,cn=etc,$SUFFIX
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
changetype: add
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
objectClass: nsContainer
objectClass: top
cn: sysaccounts
Add posix auto gen for single master case
2007-11-06 17:57:15 -06:00
dn: cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: ipa
dn: cn=masters,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: masters
Store list of non-master replicas in DIT and provide way to list them Fixes: https://fedorahosted.org/freeipa/ticket/1007
2011-02-28 16:35:44 -06:00
dn: cn=replicas,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: replicas
id ranges: change DNA configuration Change the way we specify the id ranges to force uid and gid ranges to always be the same. Add option to specify a maximum id. Change DNA configuration to use shared ranges so that masters and replicas can actually share the same overall range in a safe way. Configure replicas so that their default range is depleted. This will force them to fetch a range portion from the master on the first install. fixes: https://fedorahosted.org/freeipa/ticket/198
2010-11-11 17:15:28 -06:00
dn: cn=dna,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: dna
dn: cn=posix-ids,cn=dna,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: posix-ids
Add basic support for subordinate user/group ids New LDAP object class "ipaUserSubordinate" with four new fields: - ipasubuidnumber / ipasubuidcount - ipasubgidnumber / ipasgbuidcount New self-service permission to add subids. New command user-auto-subid to auto-assign subid The code hard-codes counts to 65536, sets subgid equal to subuid, and does not allow removal of subids. There is also a hack that emulates a DNA plugin with step interval 65536 for testing. Work around problem with older SSSD clients that fail with unknown idrange type "ipa-local-subid", see: https://github.com/SSSD/sssd/issues/5571 Related: https://pagure.io/freeipa/issue/8361 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2021-03-19 05:48:38 -05:00
dn: cn=subordinate-ids,cn=dna,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: subordinate-ids
Use certmonger to renew CA subsystem certificates Certificate renewal can be done only one one CA as the certificates need to be shared amongst them. certmonger has been trained to communicate directly with dogtag to perform the renewals. The initial CA installation is the defacto certificate renewal master. A copy of the certificate is stored in the IPA LDAP tree in cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX, the rdn being the nickname of the certificate, when a certificate is renewed. Only the most current certificate is stored. It is valid to have no certificates there, it means that no renewals have taken place. The clones are configured with a new certmonger CA type that polls this location in the IPA tree looking for an updated certificate. If one is not found then certmonger is put into the CA_WORKING state and will poll every 8 hours until an updated certificate is available. The RA agent certificate, ipaCert in /etc/httpd/alias, is a special case. When this certificate is updated we also need to update its entry in the dogtag tree, adding the updated certificate and telling dogtag which certificate to use. This is the certificate that lets IPA issue certificates. On upgrades we check to see if the certificate tracking is already in place. If not then we need to determine if this is the master that will do the renewals or not. This decision is made based on whether it was the first master installed. It is concievable that this master is no longer available meaning that none are actually tracking renewal. We will need to document this. https://fedorahosted.org/freeipa/ticket/2803
2012-07-11 14:51:01 -05:00
dn: cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: ca_renewal
Add container for certificate store. Part of https://fedorahosted.org/freeipa/ticket/3259 Part of https://fedorahosted.org/freeipa/ticket/3520 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-06-10 07:05:22 -05:00
dn: cn=certificates,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: certificates
Add ipa-custodia service Add a customized Custodia daemon and enable it after installation. Generates server keys and loads them in LDAP autonomously on install or update. Provides client code classes too. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-05-08 12:39:29 -05:00
dn: cn=custodia,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: custodia
Setup lightweight CA key retrieval on install/upgrade Add the ipa-pki-retrieve-key helper program and configure lightweight CA key replication on installation and upgrade. The specific configuration steps are: - Add the 'dogtag/$HOSTNAME' service principal - Create the pricipal's Custodia keys - Retrieve the principal's keytab - Configure Dogtag's CS.cfg to use ExternalProcessKeyRetriever to invoke ipa-pki-retrieve-key for key retrieval Also bump the minimum version of Dogtag to 10.3.2. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-05-31 17:07:33 -05:00
dn: cn=dogtag,cn=custodia,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: dogtag
Configure s4u2proxy during installation. This creates a new container, cn=s4u2proxy,cn=etc,$SUFFIX Within that container we control which services are allowed to delegate tickets for other services. Right now that is limited from the IPA HTTP to ldap services. Requires a version of mod_auth_kerb that supports s4u2proxy https://fedorahosted.org/freeipa/ticket/1098
2012-01-10 21:39:26 -06:00
dn: cn=s4u2proxy,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: s4u2proxy
dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
changetype: add
objectClass: ipaKrb5DelegationACL
objectClass: groupOfPrincipals
objectClass: top
cn: ipa-http-delegation
memberPrincipal: HTTP/$HOST@$REALM
Don't set delegation flag in client, we're using S4U2Proxy now A forwardable ticket is still required but we no longer need to send the TGT to the IPA server. A new flag, --delegate, is available if the old behavior is required. Set the minimum n-v-r for mod_auth_kerb and krb5-server to pick up needed patches for S4U2Proxy to work. https://fedorahosted.org/freeipa/ticket/1098 https://fedorahosted.org/freeipa/ticket/2246
2012-02-15 10:06:54 -06:00
ipaAllowedTarget: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
Add separate attribute to store trusted domain SID We need two attributes in the ipaNTTrustedDomain objectclass to store different kind of SID. Currently ipaNTSecurityIdentifier is used to store the Domain-SID of the trusted domain. A second attribute is needed to store the SID for the trusted domain user. Since it cannot be derived safely from other values and since it does not make sense to create a separate object for the user a new attribute is needed. https://fedorahosted.org/freeipa/ticket/2191
2012-02-28 05:22:49 -06:00
ipaAllowedTarget: cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
Configure s4u2proxy during installation. This creates a new container, cn=s4u2proxy,cn=etc,$SUFFIX Within that container we control which services are allowed to delegate tickets for other services. Right now that is limited from the IPA HTTP to ldap services. Requires a version of mod_auth_kerb that supports s4u2proxy https://fedorahosted.org/freeipa/ticket/1098
2012-01-10 21:39:26 -06:00
dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
changetype: add
objectClass: groupOfPrincipals
objectClass: top
cn: ipa-ldap-delegation-targets
memberPrincipal: ldap/$HOST@$REALM
Add separate attribute to store trusted domain SID We need two attributes in the ipaNTTrustedDomain objectclass to store different kind of SID. Currently ipaNTSecurityIdentifier is used to store the Domain-SID of the trusted domain. A second attribute is needed to store the SID for the trusted domain user. Since it cannot be derived safely from other values and since it does not make sense to create a separate object for the user a new attribute is needed. https://fedorahosted.org/freeipa/ticket/2191
2012-02-28 05:22:49 -06:00
dn: cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
changetype: add
objectClass: groupOfPrincipals
objectClass: top
cn: ipa-cifs-delegation-targets
Move admin into cn=users,cn=accounts After some deep thinking I think the advantages of keeping all posix enabled user accounts under cn=users,cn=accounts overweight a perceived better protection of the admin account by keeping it in a separate tree.
2008-05-22 16:55:27 -05:00
dn: uid=admin,cn=users,cn=accounts,$SUFFIX
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
changetype: add
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
objectClass: top
objectClass: person
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
objectClass: posixaccount
objectClass: krbprincipalaux
Add default values for krb ticket policy attributes during installation.
2010-01-12 09:30:00 -06:00
objectClass: krbticketpolicyaux
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
objectClass: inetuser
UUIDs: remove uuid python plugin and let DS always autogenerate merge in remove uuid
2010-10-26 09:26:06 -05:00
objectClass: ipaobject
Add LDAP schema for SSH public keys. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:46:23 -06:00
objectClass: ipasshuser
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
uid: admin
krbPrincipalName: admin@$REALM
Prevent local account takeover It was found that if an account was created with a name corresponding to an account local to a system, such as 'root', was created via IPA, such account could access any enrolled machine with that account, and the local system privileges. This also bypass the absence of explicit HBAC rules. root principal alias ------------------- The principal "root@REALM" is now a Kerberos principal alias for "admin". This prevent user with "User Administrator" role or "System: Add User" privilege to create an account with "root" principal name. Modified user permissions ------------------------- Several user permissions no longer apply to admin users and filter on posixaccount object class. This prevents user managers from modifying admin acounts. - System: Manage User Certificates - System: Manage User Principals - System: Manage User SSH Public Keys - System: Modify Users - System: Remove Users - System: Unlock user ``System: Unlock User`` is restricted because the permission also allow a user manager to lock an admin account. ``System: Modify Users`` is restricted to prevent user managers from changing login shell or notification channels (mail, mobile) of admin accounts. New user permission ------------------- - System: Change Admin User password The new permission allows manipulation of admin user password fields. By default only the ``PassSync Service`` privilege is allowed to modify admin user password fields. Modified group permissions -------------------------- Group permissions are now restricted as well. Group admins can no longer modify the admins group and are limited to groups with object class ``ipausergroup``. - System: Modify Groups - System: Remove Groups The permission ``System: Modify Group Membership`` was already limited. Notes ----- Admin users are mostly unaffected by the new restrictions, except for the fact that admins can no longer change krbPrincipalAlias of another admin or manipulate password fields directly. Commands like ``ipa passwd otheradmin`` still work, though. The ACI ``Admin can manage any entry`` allows admins to modify other entries and most attributes. Managed permissions don't install ``obj.permission_filter_objectclasses`` when ``ipapermtargetfilter`` is set. Group and user objects now have a ``permission_filter_objectclasses_string`` attribute that is used by new target filters. Misc changes ------------ Also add new exception AlreadyContainsValueError. BaseLDAPAddAttribute was raising a generic base class for LDAP execution errors. Fixes: https://pagure.io/freeipa/issue/8326 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1810160 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
2020-06-10 11:16:54 -05:00
krbPrincipalName: root@$REALM
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
cn: Administrator
sn: Administrator
id ranges: change DNA configuration Change the way we specify the id ranges to force uid and gid ranges to always be the same. Add option to specify a maximum id. Change DNA configuration to use shared ranges so that masters and replicas can actually share the same overall range in a safe way. Configure replicas so that their default range is depleted. This will force them to fetch a range portion from the master on the first install. fixes: https://fedorahosted.org/freeipa/ticket/198
2010-11-11 17:15:28 -06:00
uidNumber: $IDSTART
gidNumber: $IDSTART
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
homeDirectory: /home/admin
Make use of the single configuration point for the default shells For now all the default shells of users and admin are hardcoded in different parts of the project. This makes it impossible to run the test suite against the setup, which has the default shell differed from '/bin/sh'. The single configuration point for the shell of users and admin is added to overcome this limitation. Fixes: https://pagure.io/freeipa/issue/7978 Signed-off-by: Stanislav Levin <slev@altlinux.org> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2019-06-15 09:25:51 -05:00
loginShell: $DEFAULT_ADMIN_SHELL
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
gecos: Administrator
install: Use proper case for boolean values
2011-07-20 14:44:26 -05:00
nsAccountLock: FALSE
UUIDs: remove uuid python plugin and let DS always autogenerate merge in remove uuid
2010-10-26 09:26:06 -05:00
ipaUniqueID: autogenerate
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=admins,cn=groups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
Use groupOfNames and member, not groupOfUniqueNames and uniqueMember
2007-11-20 09:22:43 -06:00
objectClass: groupofnames
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
objectClass: posixgroup
Add ipaUserGroup objectClass to default groups where missing.
2009-12-01 06:41:47 -06:00
objectClass: ipausergroup
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 13:37:45 -05:00
objectClass: ipaobject
patch queue: admin_account_fix.patch
2007-10-04 15:41:19 -05:00
cn: admins
Integrate corrections pointed out on the list
2007-08-30 11:23:39 -05:00
description: Account administrators group
id ranges: change DNA configuration Change the way we specify the id ranges to force uid and gid ranges to always be the same. Add option to specify a maximum id. Change DNA configuration to use shared ranges so that masters and replicas can actually share the same overall range in a safe way. Configure replicas so that their default range is depleted. This will force them to fetch a range portion from the master on the first install. fixes: https://fedorahosted.org/freeipa/ticket/198
2010-11-11 17:15:28 -06:00
gidNumber: $IDSTART
Move admin into cn=users,cn=accounts After some deep thinking I think the advantages of keeping all posix enabled user accounts under cn=users,cn=accounts overweight a perceived better protection of the admin account by keeping it in a separate tree.
2008-05-22 16:55:27 -05:00
member: uid=admin,cn=users,cn=accounts,$SUFFIX
install: Use proper case for boolean values
2011-07-20 14:44:26 -05:00
nsAccountLock: FALSE
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 13:37:45 -05:00
ipaUniqueID: autogenerate
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=ipausers,cn=groups,cn=accounts,$SUFFIX
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
changetype: add
objectClass: top
Use groupOfNames and member, not groupOfUniqueNames and uniqueMember
2007-11-20 09:22:43 -06:00
objectClass: groupofnames
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
objectClass: nestedgroup
objectClass: ipausergroup
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 13:37:45 -05:00
objectClass: ipaobject
Add an editors group. This is used to generally grant access for users to edit other users (the Edit link won't appear otherwise). Additional delegation is need to grant permission to individual attributes. Update the failed login page to indicate that it is a permission issue. Don't allow access to policy at all for non-admins. By default users can only edit themselves.
2007-11-14 09:49:03 -06:00
description: Default group for all users
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
cn: ipausers
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 13:37:45 -05:00
ipaUniqueID: autogenerate
Add an editors group. This is used to generally grant access for users to edit other users (the Edit link won't appear otherwise). Additional delegation is need to grant permission to individual attributes. Update the failed login page to indicate that it is a permission issue. Don't allow access to policy at all for non-admins. By default users can only edit themselves.
2007-11-14 09:49:03 -06:00
dn: cn=editors,cn=groups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
Use groupOfNames and member, not groupOfUniqueNames and uniqueMember
2007-11-20 09:22:43 -06:00
objectClass: groupofnames
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
objectClass: posixgroup
Add ipaUserGroup objectClass to default groups where missing.
2009-12-01 06:41:47 -06:00
objectClass: ipausergroup
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 13:37:45 -05:00
objectClass: ipaobject
id ranges: change DNA configuration Change the way we specify the id ranges to force uid and gid ranges to always be the same. Add option to specify a maximum id. Change DNA configuration to use shared ranges so that masters and replicas can actually share the same overall range in a safe way. Configure replicas so that their default range is depleted. This will force them to fetch a range portion from the master on the first install. fixes: https://fedorahosted.org/freeipa/ticket/198
2010-11-11 17:15:28 -06:00
gidNumber: eval($IDSTART+2)
Add an editors group. This is used to generally grant access for users to edit other users (the Edit link won't appear otherwise). Additional delegation is need to grant permission to individual attributes. Update the failed login page to indicate that it is a permission issue. Don't allow access to policy at all for non-admins. By default users can only edit themselves.
2007-11-14 09:49:03 -06:00
description: Limited admins who can edit other users
cn: editors
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 13:37:45 -05:00
ipaUniqueID: autogenerate
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 11:59:32 -06:00
aci: add IPA servers host group 'ipaservers' https://fedorahosted.org/freeipa/ticket/3416 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-12-01 03:42:38 -06:00
dn: cn=ipaservers,cn=hostgroups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: groupOfNames
objectClass: nestedGroup
objectClass: ipaobject
objectClass: ipahostgroup
description: IPA server hosts
cn: ipaservers
ipaUniqueID: autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=sshd,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: sshd
description: sshd
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=ftp,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: ftp
description: ftp
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=su,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: su
description: su
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=login,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: login
description: login
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=su-l,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: su-l
description: su with login shell
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=sudo,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: sudo
description: sudo
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=sudo-i,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: sudo-i
description: sudo-i
ipauniqueid:autogenerate
Create systemd-user HBAC service and rule authselect changed pam_systemd session from optional to required. When the HBAC rule allow_all is disabled and replaced with more fine grained rules, loginsi now to fail, because systemd's user@.service is able to create a systemd session. Add systemd-user HBAC service and a HBAC rule that allows systemd-user to run on all hosts for all users by default. ipa-server-upgrade creates the service and rule, too. In case the service already exists, no attempt is made to create the rule. This allows admins to delete the rule permanently. See: https://bugzilla.redhat.com/show_bug.cgi?id=1643928 Fixes: https://pagure.io/freeipa/issue/7831 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2019-01-11 04:18:05 -06:00
dn: cn=systemd-user,cn=hbacservices,cn=hbac,$SUFFIX
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: systemd-user
description: pam_systemd and systemd user@.service
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=gdm,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: gdm
description: gdm
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=gdm-password,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: gdm-password
description: gdm-password
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=kdm,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: kdm
description: kdm
ipauniqueid:autogenerate
Use Sudo rather than SUDO as a label. ticket 1005
2011-02-28 10:44:27 -06:00
dn: cn=Sudo,cn=hbacservicegroups,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectClass: ipaobject
objectClass: ipahbacservicegroup
objectClass: nestedGroup
objectClass: groupOfNames
objectClass: top
Use Sudo rather than SUDO as a label. ticket 1005
2011-02-28 10:44:27 -06:00
cn: Sudo
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
ipauniqueid:autogenerate
Use Sudo rather than SUDO as a label. ticket 1005
2011-02-28 10:44:27 -06:00
description: Default group of Sudo related services
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
member: cn=sudo,cn=hbacservices,cn=hbac,$SUFFIX
member: cn=sudo-i,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
Minor fixes.
0000-12-31 18:09:24 -05:50
dn: cn=ipaConfig,cn=etc,$SUFFIX
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 11:59:32 -06:00
changetype: add
objectClass: nsContainer
objectClass: top
objectClass: ipaGuiConfig
Add options to control NTLM hashes By default LM hash is disabled. Of course generation still depends on whether the SamAccount objectclass is present in the user object.
2010-10-04 14:13:36 -05:00
objectClass: ipaConfigObject
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
ipaUserSearchFields: uid,givenname,sn,telephonenumber,ou,title
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 11:59:32 -06:00
ipaGroupSearchFields: cn,description
ipaSearchTimeLimit: 2
Default search limit to 100
2010-10-18 16:07:01 -05:00
ipaSearchRecordsLimit: 100
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 11:59:32 -06:00
ipaHomesRootDir: /home
Make use of the single configuration point for the default shells For now all the default shells of users and admin are hardcoded in different parts of the project. This makes it impossible to run the test suite against the setup, which has the default shell differed from '/bin/sh'. The single configuration point for the shell of users and admin is added to overcome this limitation. Fixes: https://pagure.io/freeipa/issue/7978 Signed-off-by: Stanislav Levin <slev@altlinux.org> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2019-06-15 09:25:51 -05:00
ipaDefaultLoginShell: $DEFAULT_SHELL
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 11:59:32 -06:00
ipaDefaultPrimaryGroup: ipausers
Increase # of chars in users and groups to 255 and default username to 32. ticket 434
2010-11-10 16:30:01 -06:00
ipaMaxUsernameLength: 32
Add knob to limit hostname length On Linux systems the length limit for hostnames is hardcoded at 64 in MAXHOSTNAMELEN Solaris, for example, allows 255 characters, and DNS allows the total length to be up to 255 (with each label < 64). Add a knob to allow configuring the maximum hostname length (FQDN) The same validators are used between hosts and DNS to apply the knob only when dealing with a FQDN as a hostname. The maxlen option is included so installers can limit the length of allowed hostnames when the --hostname option is used. https://pagure.io/freeipa/issue/2018 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2019-05-01 09:15:37 -05:00
ipaMaxHostnameLength: 64
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 11:59:32 -06:00
ipaPwdExpAdvNotify: 4
Utilize user and group objectclass lists in cn=ipaconfig Change the syntax on user and group objectclasses in cn=ipaconfig
2007-12-05 23:30:26 -06:00
ipaGroupObjectClasses: top
ipaGroupObjectClasses: groupofnames
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
ipaGroupObjectClasses: nestedgroup
ipaGroupObjectClasses: ipausergroup
Add a new objectclass, ipaObject, that will add a UUID to many IPA objects ipaObject is defined as an auxiliary objectclass so it is up to the plugin author to ensure that the objectclass is included an a UUID generated. ipaUniqueId is a MUST attribute so if you include the objectclass you must ensure that the uuid is generated. This also fixes up some unrelated unit test failures.
2009-08-10 15:24:10 -05:00
ipaGroupObjectClasses: ipaobject
Utilize user and group objectclass lists in cn=ipaconfig Change the syntax on user and group objectclasses in cn=ipaconfig
2007-12-05 23:30:26 -06:00
ipaUserObjectClasses: top
ipaUserObjectClasses: person
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
ipaUserObjectClasses: organizationalperson
ipaUserObjectClasses: inetorgperson
ipaUserObjectClasses: inetuser
ipaUserObjectClasses: posixaccount
ipaUserObjectClasses: krbprincipalaux
Add default values for krb ticket policy attributes during installation.
2010-01-12 09:30:00 -06:00
ipaUserObjectClasses: krbticketpolicyaux
Add a new objectclass, ipaObject, that will add a UUID to many IPA objects ipaObject is defined as an auxiliary objectclass so it is up to the plugin author to ensure that the objectclass is included an a UUID generated. ipaUniqueId is a MUST attribute so if you include the objectclass you must ensure that the uuid is generated. This also fixes up some unrelated unit test failures.
2009-08-10 15:24:10 -05:00
ipaUserObjectClasses: ipaobject
Add LDAP schema for SSH public keys. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:46:23 -06:00
ipaUserObjectClasses: ipasshuser
Add default e-mail domain to the IPA configuration
2007-12-10 10:53:00 -06:00
ipaDefaultEmailDomain: $DOMAIN
Add BIND pre-op for DS->IPA password migration to ipa-pwd-extop DS plugin.
2009-09-04 07:51:28 -05:00
ipaMigrationEnabled: FALSE
Add options to control NTLM hashes By default LM hash is disabled. Of course generation still depends on whether the SamAccount objectclass is present in the user object.
2010-10-04 14:13:36 -05:00
ipaConfigString: AllowNThash
Set "KDC:Disable Last Success" by default In big deployments enabled recording of the last sucesfull login this creates a huge changelog on DS side and cause performance issues even if this is excluded from replication. Actually this is not used directly by FreeIPA so it is safe to remove in new installations. User who need this must manually remove "KDC:Disable Last Success" using `ipa config-mod` command or WebUI. https://pagure.io/freeipa/issue/5313 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-03-22 11:47:04 -05:00
ipaConfigString: KDC:Disable Last Success
Make use of single configuration point for SELinux For now, FreeIPA supports SELinux things as they are in RedHat/Fedora. But different distributions may have their own SELinux customizations. This moves SELinux configuration out to platform constants: - SELINUX_MCS_MAX - SELINUX_MCS_REGEX - SELINUX_MLS_MAX - SELINUX_MLS_REGEX - SELINUX_USER_REGEX - SELINUX_USERMAP_DEFAULT - SELINUX_USERMAP_ORDER and applies corresponding changes to the test code. Fixes: https://pagure.io/freeipa/issue/7996 Signed-off-by: Stanislav Levin <slev@altlinux.org> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2019-06-27 03:52:40 -05:00
ipaSELinuxUserMapOrder: $SELINUX_USERMAP_ORDER
ipaSELinuxUserMapDefault: $SELINUX_USERMAP_DEFAULT
Enable group inactivation by using the Class of Service plugin. This adds 2 new groups: activated and inactivated. If you, or a group you are a member of, is in inactivated then you are too. If you, or a group you are a member of, is in the activated group, then you are too. In a fight between activated and inactivated, activated wins. The DNs for doing this matching is case and white space sensitive. The goal is to never have to actually set nsAccountLock in a user directly but move them between these groups. We need to decide where in the CLI this will happen. Right it is split between ipa-deluser and ipa-usermod. To inactivate groups for now just add the group to inactivate or active.
2007-11-20 21:45:29 -06:00
dn: cn=cosTemplates,cn=accounts,$SUFFIX
Add utility to lock user accounts. Remove lock capability from ipa-deluser Fix bootstrap.ldif to add new Class of Service entries properly Include some man pages that weren't being installed
2007-11-26 21:28:53 -06:00
changetype: add
Enable group inactivation by using the Class of Service plugin. This adds 2 new groups: activated and inactivated. If you, or a group you are a member of, is in inactivated then you are too. If you, or a group you are a member of, is in the activated group, then you are too. In a fight between activated and inactivated, activated wins. The DNs for doing this matching is case and white space sensitive. The goal is to never have to actually set nsAccountLock in a user directly but move them between these groups. We need to decide where in the CLI this will happen. Right it is split between ipa-deluser and ipa-usermod. To inactivate groups for now just add the group to inactivate or active.
2007-11-20 21:45:29 -06:00
objectclass: top
objectclass: nsContainer
cn: cosTemplates
Add support for per-group kerberos password policy. Use a Class of Service template to do per-group password policy. The design calls for non-overlapping groups but with cospriority we can still make sense of things. The password policy entries stored under the REALM are keyed only on the group name because the MIT ldap plugin can't handle quotes in the DN. It also can't handle spaces between elements in the DN.
2009-10-02 08:30:16 -05:00
# templates for this cos definition are managed by the pwpolicy plugin
dn: cn=Password Policy,cn=accounts,$SUFFIX
changetype: add
description: Password Policy based on group membership
objectClass: top
objectClass: ldapsubentry
objectClass: cosSuperDefinition
objectClass: cosClassicDefinition
cosTemplateDn: cn=cosTemplates,cn=accounts,$SUFFIX
Use kerberos password policy. This lets the KDC count password failures and can lock out accounts for a period of time. This only works for KDC >= 1.8. There currently is no way to unlock a locked account across a replica. MIT Kerberos 1.9 is adding support for doing so. Once that is available unlock will be added. The concept of a "global" password policy has changed. When we were managing the policy using the IPA password plugin it was smart enough to search up the tree looking for a policy. The KDC is not so smart and relies on the krbpwdpolicyreference to find the policy. For this reason every user entry requires this attribute. I've created a new global_policy entry to store the default password policy. All users point at this now. The group policy works the same and can override this setting. As a result the special "GLOBAL" name has been replaced with global_policy. This policy works like any other and is the default if a name is not provided on the command-line. ticket 51
2010-10-25 16:58:37 -05:00
cosAttribute: krbPwdPolicyReference override
Add support for per-group kerberos password policy. Use a Class of Service template to do per-group password policy. The design calls for non-overlapping groups but with cospriority we can still make sense of things. The password policy entries stored under the REALM are keyed only on the group name because the MIT ldap plugin can't handle quotes in the DN. It also can't handle spaces between elements in the DN.
2009-10-02 08:30:16 -05:00
cosSpecifier: memberOf
Add SELinux user mapping framework. This will allow one to define what SELinux context a given user gets on a given machine. A rule can contain a set of users and hosts or it can point to an existing HBAC rule that defines them. https://fedorahosted.org/freeipa/ticket/755
2011-11-23 15:59:21 -06:00
dn: cn=selinux,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: selinux
dn: cn=usermap,cn=selinux,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: usermap
Add objects for initial ID range
2012-06-12 04:58:41 -05:00
dn: cn=ranges,cn=etc,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: ranges
Create default range entry after upgrade Create default range both on new install and on upgrades. Also make sure that all range object classes are present for upgraded machines. Default range LDIF entry for new install was fixed so that new installation does not crash. https://fedorahosted.org/freeipa/ticket/2891
2012-07-02 07:07:01 -05:00
dn: cn=${REALM}_id_range,cn=ranges,cn=etc,$SUFFIX
Add objects for initial ID range
2012-06-12 04:58:41 -05:00
changetype: add
objectClass: top
objectClass: ipaIDrange
objectClass: ipaDomainIDRange
Create default range entry after upgrade Create default range both on new install and on upgrades. Also make sure that all range object classes are present for upgraded machines. Default range LDIF entry for new install was fixed so that new installation does not crash. https://fedorahosted.org/freeipa/ticket/2891
2012-07-02 07:07:01 -05:00
cn: ${REALM}_id_range
Add objects for initial ID range
2012-06-12 04:58:41 -05:00
ipaBaseID: $IDSTART
ipaIDRangeSize: $IDRANGE_SIZE
Add ipaRangeType attribute to LDAP Schema This adds a new LDAP attribute ipaRangeType with OID 2.16.840.1.113730.3.8.11.41 to the LDAP Schema. ObjectClass ipaIDrange has been altered to require ipaRangeType attribute. Part of https://fedorahosted.org/freeipa/ticket/3647
2013-05-30 07:02:44 -05:00
ipaRangeType: ipa-local
Add schema for certificate profiles The certprofile object class is used to track IPA-managed certificate profiles in Dogtag and store IPA-specific settings. Part of: https://fedorahosted.org/freeipa/ticket/57 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-04-21 01:24:10 -05:00
Add basic support for subordinate user/group ids New LDAP object class "ipaUserSubordinate" with four new fields: - ipasubuidnumber / ipasubuidcount - ipasubgidnumber / ipasgbuidcount New self-service permission to add subids. New command user-auto-subid to auto-assign subid The code hard-codes counts to 65536, sets subgid equal to subuid, and does not allow removal of subids. There is also a hack that emulates a DNA plugin with step interval 65536 for testing. Work around problem with older SSSD clients that fail with unknown idrange type "ipa-local-subid", see: https://github.com/SSSD/sssd/issues/5571 Related: https://pagure.io/freeipa/issue/8361 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2021-03-19 05:48:38 -05:00
dn: cn=${REALM}_subid_range,cn=ranges,cn=etc,$SUFFIX
changetype: add
objectClass: top
objectClass: ipaIDrange
objectClass: ipaTrustedADDomainRange
cn: ${REALM}_subid_range
ipaBaseID: eval($SUBID_RANGE_START)
ipaIDRangeSize: eval($SUBID_RANGE_SIZE)
# HACK: RIDs to work around adtrust sidgen issue
Fix ipa-server-upgrade Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2021-05-21 07:56:32 -05:00
ipaBaseRID: eval($SUBID_BASE_RID)
Add basic support for subordinate user/group ids New LDAP object class "ipaUserSubordinate" with four new fields: - ipasubuidnumber / ipasubuidcount - ipasubgidnumber / ipasgbuidcount New self-service permission to add subids. New command user-auto-subid to auto-assign subid The code hard-codes counts to 65536, sets subgid equal to subuid, and does not allow removal of subids. There is also a hack that emulates a DNA plugin with step interval 65536 for testing. Work around problem with older SSSD clients that fail with unknown idrange type "ipa-local-subid", see: https://github.com/SSSD/sssd/issues/5571 Related: https://pagure.io/freeipa/issue/8361 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2021-03-19 05:48:38 -05:00
# 738065-838566 = IPA-SUB
ipaNTTrustedDomainSID: S-1-5-21-738065-838566-$DOMAIN_HASH
# HACK: "ipa-local-subid" range type causes issues with older SSSD clients
# see https://github.com/SSSD/sssd/issues/5571
ipaRangeType: ipa-ad-trust
Add schema for certificate profiles The certprofile object class is used to track IPA-managed certificate profiles in Dogtag and store IPA-specific settings. Part of: https://fedorahosted.org/freeipa/ticket/57 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-04-21 01:24:10 -05:00
dn: cn=ca,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: ca
dn: cn=certprofiles,cn=ca,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: certprofiles
Add CA ACL plugin Implement the caacl commands, which are used to indicate which principals may be issued certificates from which (sub-)CAs, using which profiles. At this commit, and until sub-CAs are implemented, all rules refer to the top-level CA (represented as ".") and no ca-ref argument is exposed. Also, during install and upgrade add a default CA ACL that permits certificate issuance for all hosts and services using the profile 'caIPAserviceCert' on the top-level CA. Part of: https://fedorahosted.org/freeipa/ticket/57 Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-05-25 07:39:07 -05:00
dn: cn=caacls,cn=ca,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: caacls
Add 'ca' plugin This commit adds the 'ca' plugin for creating and managing lightweight CAs. The initial implementation supports a single level of sub-CAs underneath the IPA CA. This commit also: - adds the container for FreeIPA CA objects - adds schema for the FreeIPA CA objects - updates ipa-pki-proxy.conf to allow access to the Dogtag lightweight CAs REST API. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-05-14 00:46:06 -05:00
dn: cn=cas,cn=ca,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: cas
Reference in New Issue Copy Permalink