freeipa/install/updates/10-config.update

# Enforce matching SSL certificate host names when 389-ds acts as an SSL
# client. A restart is necessary for this to take effect, we do one when
# upgrading.
dn: cn=config
only:nsslapd-ssl-check-hostname: on

# Set the precedence of the ipa-modrdn plugin so it runs after other
# plugins (the default is 50).
dn: cn=Kerberos Principal Name,cn=IPA MODRDN,cn=plugins,cn=config
only: nsslapd-pluginPrecedence: 60
Enable 389-ds SSL host checking by defauilt Enforce that the remote hostname matches the remote SSL server certificate when 389-ds operates as an SSL client. Also add an update file to turn this off for existing installations. This also changes the way the ldapupdater modlist is generated to be more like the framework. Single-value attributes are done as replacements and there is a list of force-replacement attributes. ticket 1069 2011-05-19 21:30:53 -05:00			`# Enforce matching SSL certificate host names when 389-ds acts as an SSL`
			`# client. A restart is necessary for this to take effect, we do one when`
			`# upgrading.`
			`dn: cn=config`
			`only:nsslapd-ssl-check-hostname: on`
Set the ipa-modrdn plugin precedence to 60 so it runs last The default precedence for plugins is 50 and the run in more or less alphabetical order (but not guaranteed). This plugin needs to run after the others have already done their work. https://fedorahosted.org/freeipa/ticket/1370 2011-07-16 12:35:30 -05:00
			`# Set the precedence of the ipa-modrdn plugin so it runs after other`
			`# plugins (the default is 50).`
			`dn: cn=Kerberos Principal Name,cn=IPA MODRDN,cn=plugins,cn=config`
			`only: nsslapd-pluginPrecedence: 60`