IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity
Files
638a9701724e4cf6cb0e11ad5a8c61b37019c797
freeipa/install/share/bootstrap-template.ldif

404 lines
8.7 KiB
Plaintext
Raw Normal View History

Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 18:07:05 -04:00
dn: cn=accounts,$SUFFIX
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested!
2007-06-28 19:09:54 -04:00
changetype: add
import initial install tool
-
objectClass: top
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 18:07:05 -04:00
objectClass: nsContainer
cn: accounts
import initial install tool
-
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 18:07:05 -04:00
dn: cn=users,cn=accounts,$SUFFIX
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested!
2007-06-28 19:09:54 -04:00
changetype: add
import initial install tool
-
objectClass: top
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 18:07:05 -04:00
objectClass: nsContainer
cn: users
import initial install tool
-
More DIT fixes discovered after testing
2007-08-31 18:36:54 -04:00
dn: cn=groups,cn=accounts,$SUFFIX
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested!
2007-06-28 19:09:54 -04:00
changetype: add
import initial install tool
-
objectClass: top
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 18:07:05 -04:00
objectClass: nsContainer
cn: groups
import initial install tool
-
Add xml-rpc interface for getting keytabs. Warning: this lacks any sort of authorization.
-
dn: cn=services,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: services
import initial install tool
-
minor typos
2007-11-30 16:58:02 -05:00
dn: cn=computers,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: computers
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 13:23:04 -05:00
dn: cn=hostgroups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: hostgroups
dn: cn=alt,$SUFFIX
changetype: add
objectClass: nsContainer
cn: alt
dn: cn=ng,cn=alt,$SUFFIX
changetype: add
objectClass: nsContainer
cn: ng
dn: cn=automount,$SUFFIX
changetype: add
objectClass: nsContainer
cn: automount
dn: cn=default,cn=automount,$SUFFIX
changetype: add
objectClass: nsContainer
cn: default
dn: automountmapname=auto.master,cn=default,cn=automount,$SUFFIX
changetype: add
objectClass: automountMap
automountMapName: auto.master
dn: automountmapname=auto.direct,cn=default,cn=automount,$SUFFIX
changetype: add
objectClass: automountMap
automountMapName: auto.direct
Enforce uniqueness on (key,info) pairs in automount keys https://fedorahosted.org/freeipa/ticket/293
2010-12-19 20:23:16 +01:00
dn: description=/- auto.direct,automountmapname=auto.master,cn=default,cn=automount,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 13:23:04 -05:00
changetype: add
objectClass: automount
automountKey: /-
automountInformation: auto.direct
Enforce uniqueness on (key,info) pairs in automount keys https://fedorahosted.org/freeipa/ticket/293
2010-12-19 20:23:16 +01:00
description: /- auto.direct
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 13:23:04 -05:00
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 10:56:17 +01:00
dn: cn=hbac,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: hbac
dn: cn=hbacservices,cn=hbac,$SUFFIX
Add groups of services to HBAC Replace serviceName with memberService so we can assign individual services or groups of services to an HBAC rule. 588574
2010-05-14 09:37:54 -04:00
changetype: add
objectClass: top
objectClass: nsContainer
cn: hbacservices
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 10:56:17 +01:00
dn: cn=hbacservicegroups,cn=hbac,$SUFFIX
Add groups of services to HBAC Replace serviceName with memberService so we can assign individual services or groups of services to an HBAC rule. 588574
2010-05-14 09:37:54 -04:00
changetype: add
objectClass: top
objectClass: nsContainer
cn: hbacservicegroups
Move sudo related data all under cn=sudo Fixes: https://fedorahosted.org/freeipa/ticket/773
2011-01-14 15:27:56 -05:00
dn: cn=sudo,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: sudo
dn: cn=sudocmds,cn=sudo,$SUFFIX
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 13:51:28 -07:00
changetype: add
objectClass: top
objectClass: nsContainer
cn: sudocmds
Move sudo related data all under cn=sudo Fixes: https://fedorahosted.org/freeipa/ticket/773
2011-01-14 15:27:56 -05:00
dn: cn=sudocmdgroups,cn=sudo,$SUFFIX
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 13:51:28 -07:00
changetype: add
objectClass: top
objectClass: nsContainer
cn: sudocmdgroups
Move sudo related data all under cn=sudo Fixes: https://fedorahosted.org/freeipa/ticket/773
2011-01-14 15:27:56 -05:00
dn: cn=sudorules,cn=sudo,$SUFFIX
Add HBAC plugin and introduce GeneralizedTime parameter type.
2009-09-30 16:24:25 +02:00
changetype: add
objectClass: top
objectClass: nsContainer
Move sudo related data all under cn=sudo Fixes: https://fedorahosted.org/freeipa/ticket/773
2011-01-14 15:27:56 -05:00
cn: sudorules
Add HBAC plugin and introduce GeneralizedTime parameter type.
2009-09-30 16:24:25 +02:00
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 18:07:05 -04:00
dn: cn=etc,$SUFFIX
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 10:05:53 -04:00
changetype: add
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 18:07:05 -04:00
objectClass: nsContainer
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 10:05:53 -04:00
objectClass: top
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 18:07:05 -04:00
cn: etc
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 10:05:53 -04:00
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 18:07:05 -04:00
dn: cn=sysaccounts,cn=etc,$SUFFIX
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 10:05:53 -04:00
changetype: add
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 18:07:05 -04:00
objectClass: nsContainer
objectClass: top
cn: sysaccounts
Add container and initial ACIs for entitlement support The entitlement entries themselves will be rather simple, consisting of the objectClasses ipaObject and pkiUser. We will just store userCertificate in it. The DN will contain the UUID of the entitlement. ticket #27
2010-07-21 15:44:49 -04:00
dn: cn=entitlements,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: entitlements
Add posix auto gen for single master case
2007-11-06 15:57:15 -08:00
dn: cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: ipa
dn: cn=masters,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: masters
Store list of non-master replicas in DIT and provide way to list them Fixes: https://fedorahosted.org/freeipa/ticket/1007
2011-02-28 17:35:44 -05:00
dn: cn=replicas,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: replicas
id ranges: change DNA configuration Change the way we specify the id ranges to force uid and gid ranges to always be the same. Add option to specify a maximum id. Change DNA configuration to use shared ranges so that masters and replicas can actually share the same overall range in a safe way. Configure replicas so that their default range is depleted. This will force them to fetch a range portion from the master on the first install. fixes: https://fedorahosted.org/freeipa/ticket/198
2010-11-11 18:15:28 -05:00
dn: cn=dna,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: dna
dn: cn=posix-ids,cn=dna,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: posix-ids
Configure s4u2proxy during installation. This creates a new container, cn=s4u2proxy,cn=etc,$SUFFIX Within that container we control which services are allowed to delegate tickets for other services. Right now that is limited from the IPA HTTP to ldap services. Requires a version of mod_auth_kerb that supports s4u2proxy https://fedorahosted.org/freeipa/ticket/1098
2012-01-10 22:39:26 -05:00
dn: cn=s4u2proxy,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: s4u2proxy
dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
changetype: add
objectClass: ipaKrb5DelegationACL
objectClass: groupOfPrincipals
objectClass: top
cn: ipa-http-delegation
memberPrincipal: HTTP/$HOST@$REALM
ipaAllowedTarget: cn=ipa-ldap-delegation-targets,cn=etc,$SUFFIX
dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
changetype: add
objectClass: groupOfPrincipals
objectClass: top
cn: ipa-ldap-delegation-targets
memberPrincipal: ldap/$HOST@$REALM
Move admin into cn=users,cn=accounts After some deep thinking I think the advantages of keeping all posix enabled user accounts under cn=users,cn=accounts overweight a perceived better protection of the admin account by keeping it in a separate tree.
2008-05-22 17:55:27 -04:00
dn: uid=admin,cn=users,cn=accounts,$SUFFIX
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 18:07:05 -04:00
changetype: add
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 10:05:53 -04:00
objectClass: top
objectClass: person
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 12:17:42 +02:00
objectClass: posixaccount
objectClass: krbprincipalaux
Add default values for krb ticket policy attributes during installation.
2010-01-12 16:30:00 +01:00
objectClass: krbticketpolicyaux
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 12:17:42 +02:00
objectClass: inetuser
UUIDs: remove uuid python plugin and let DS always autogenerate merge in remove uuid
2010-10-26 10:26:06 -04:00
objectClass: ipaobject
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 18:07:05 -04:00
uid: admin
krbPrincipalName: admin@$REALM
cn: Administrator
sn: Administrator
id ranges: change DNA configuration Change the way we specify the id ranges to force uid and gid ranges to always be the same. Add option to specify a maximum id. Change DNA configuration to use shared ranges so that masters and replicas can actually share the same overall range in a safe way. Configure replicas so that their default range is depleted. This will force them to fetch a range portion from the master on the first install. fixes: https://fedorahosted.org/freeipa/ticket/198
2010-11-11 18:15:28 -05:00
uidNumber: $IDSTART
gidNumber: $IDSTART
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 18:07:05 -04:00
homeDirectory: /home/admin
loginShell: /bin/bash
gecos: Administrator
install: Use proper case for boolean values
2011-07-20 15:44:26 -04:00
nsAccountLock: FALSE
UUIDs: remove uuid python plugin and let DS always autogenerate merge in remove uuid
2010-10-26 10:26:06 -04:00
ipaUniqueID: autogenerate
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 18:07:05 -04:00
dn: cn=admins,cn=groups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
Use groupOfNames and member, not groupOfUniqueNames and uniqueMember
2007-11-20 10:22:43 -05:00
objectClass: groupofnames
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 12:17:42 +02:00
objectClass: posixgroup
Add ipaUserGroup objectClass to default groups where missing.
2009-12-01 13:41:47 +01:00
objectClass: ipausergroup
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 14:37:45 -04:00
objectClass: ipaobject
patch queue: admin_account_fix.patch
2007-10-04 13:41:19 -07:00
cn: admins
Integrate corrections pointed out on the list
2007-08-30 12:23:39 -04:00
description: Account administrators group
id ranges: change DNA configuration Change the way we specify the id ranges to force uid and gid ranges to always be the same. Add option to specify a maximum id. Change DNA configuration to use shared ranges so that masters and replicas can actually share the same overall range in a safe way. Configure replicas so that their default range is depleted. This will force them to fetch a range portion from the master on the first install. fixes: https://fedorahosted.org/freeipa/ticket/198
2010-11-11 18:15:28 -05:00
gidNumber: $IDSTART
Move admin into cn=users,cn=accounts After some deep thinking I think the advantages of keeping all posix enabled user accounts under cn=users,cn=accounts overweight a perceived better protection of the admin account by keeping it in a separate tree.
2008-05-22 17:55:27 -04:00
member: uid=admin,cn=users,cn=accounts,$SUFFIX
install: Use proper case for boolean values
2011-07-20 15:44:26 -04:00
nsAccountLock: FALSE
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 14:37:45 -04:00
ipaUniqueID: autogenerate
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 10:05:53 -04:00
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 18:07:05 -04:00
dn: cn=ipausers,cn=groups,cn=accounts,$SUFFIX
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 10:05:53 -04:00
changetype: add
objectClass: top
Use groupOfNames and member, not groupOfUniqueNames and uniqueMember
2007-11-20 10:22:43 -05:00
objectClass: groupofnames
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 12:17:42 +02:00
objectClass: nestedgroup
objectClass: ipausergroup
objectClass: posixgroup
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 14:37:45 -04:00
objectClass: ipaobject
id ranges: change DNA configuration Change the way we specify the id ranges to force uid and gid ranges to always be the same. Add option to specify a maximum id. Change DNA configuration to use shared ranges so that masters and replicas can actually share the same overall range in a safe way. Configure replicas so that their default range is depleted. This will force them to fetch a range portion from the master on the first install. fixes: https://fedorahosted.org/freeipa/ticket/198
2010-11-11 18:15:28 -05:00
gidNumber: eval($IDSTART+1)
Add an editors group. This is used to generally grant access for users to edit other users (the Edit link won't appear otherwise). Additional delegation is need to grant permission to individual attributes. Update the failed login page to indicate that it is a permission issue. Don't allow access to policy at all for non-admins. By default users can only edit themselves.
2007-11-14 10:49:03 -05:00
description: Default group for all users
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 18:07:05 -04:00
cn: ipausers
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 14:37:45 -04:00
ipaUniqueID: autogenerate
Add an editors group. This is used to generally grant access for users to edit other users (the Edit link won't appear otherwise). Additional delegation is need to grant permission to individual attributes. Update the failed login page to indicate that it is a permission issue. Don't allow access to policy at all for non-admins. By default users can only edit themselves.
2007-11-14 10:49:03 -05:00
dn: cn=editors,cn=groups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
Use groupOfNames and member, not groupOfUniqueNames and uniqueMember
2007-11-20 10:22:43 -05:00
objectClass: groupofnames
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 12:17:42 +02:00
objectClass: posixgroup
Add ipaUserGroup objectClass to default groups where missing.
2009-12-01 13:41:47 +01:00
objectClass: ipausergroup
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 14:37:45 -04:00
objectClass: ipaobject
id ranges: change DNA configuration Change the way we specify the id ranges to force uid and gid ranges to always be the same. Add option to specify a maximum id. Change DNA configuration to use shared ranges so that masters and replicas can actually share the same overall range in a safe way. Configure replicas so that their default range is depleted. This will force them to fetch a range portion from the master on the first install. fixes: https://fedorahosted.org/freeipa/ticket/198
2010-11-11 18:15:28 -05:00
gidNumber: eval($IDSTART+2)
Add an editors group. This is used to generally grant access for users to edit other users (the Edit link won't appear otherwise). Additional delegation is need to grant permission to individual attributes. Update the failed login page to indicate that it is a permission issue. Don't allow access to policy at all for non-admins. By default users can only edit themselves.
2007-11-14 10:49:03 -05:00
description: Limited admins who can edit other users
cn: editors
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 14:37:45 -04:00
ipaUniqueID: autogenerate
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 12:59:32 -05:00
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 10:56:17 +01:00
dn: cn=sshd,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 13:23:04 -05:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: sshd
description: sshd
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 10:56:17 +01:00
dn: cn=ftp,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 13:23:04 -05:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: ftp
description: ftp
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 10:56:17 +01:00
dn: cn=su,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 13:23:04 -05:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: su
description: su
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 10:56:17 +01:00
dn: cn=login,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 13:23:04 -05:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: login
description: login
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 10:56:17 +01:00
dn: cn=su-l,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 13:23:04 -05:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: su-l
description: su with login shell
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 10:56:17 +01:00
dn: cn=sudo,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 13:23:04 -05:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: sudo
description: sudo
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 10:56:17 +01:00
dn: cn=sudo-i,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 13:23:04 -05:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: sudo-i
description: sudo-i
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 10:56:17 +01:00
dn: cn=gdm,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 13:23:04 -05:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: gdm
description: gdm
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 10:56:17 +01:00
dn: cn=gdm-password,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 13:23:04 -05:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: gdm-password
description: gdm-password
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 10:56:17 +01:00
dn: cn=kdm,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 13:23:04 -05:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: kdm
description: kdm
ipauniqueid:autogenerate
Use Sudo rather than SUDO as a label. ticket 1005
2011-02-28 11:44:27 -05:00
dn: cn=Sudo,cn=hbacservicegroups,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 13:23:04 -05:00
changetype: add
objectClass: ipaobject
objectClass: ipahbacservicegroup
objectClass: nestedGroup
objectClass: groupOfNames
objectClass: top
Use Sudo rather than SUDO as a label. ticket 1005
2011-02-28 11:44:27 -05:00
cn: Sudo
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 13:23:04 -05:00
ipauniqueid:autogenerate
Use Sudo rather than SUDO as a label. ticket 1005
2011-02-28 11:44:27 -05:00
description: Default group of Sudo related services
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 10:56:17 +01:00
member: cn=sudo,cn=hbacservices,cn=hbac,$SUFFIX
member: cn=sudo-i,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 13:23:04 -05:00
Minor fixes.
-
dn: cn=ipaConfig,cn=etc,$SUFFIX
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 12:59:32 -05:00
changetype: add
objectClass: nsContainer
objectClass: top
objectClass: ipaGuiConfig
Add options to control NTLM hashes By default LM hash is disabled. Of course generation still depends on whether the SamAccount objectclass is present in the user object.
2010-10-04 15:13:36 -04:00
objectClass: ipaConfigObject
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 12:17:42 +02:00
ipaUserSearchFields: uid,givenname,sn,telephonenumber,ou,title
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 12:59:32 -05:00
ipaGroupSearchFields: cn,description
ipaSearchTimeLimit: 2
Default search limit to 100
2010-10-18 17:07:01 -04:00
ipaSearchRecordsLimit: 100
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 12:59:32 -05:00
ipaHomesRootDir: /home
ipaDefaultLoginShell: /bin/sh
ipaDefaultPrimaryGroup: ipausers
Increase # of chars in users and groups to 255 and default username to 32. ticket 434
2010-11-10 17:30:01 -05:00
ipaMaxUsernameLength: 32
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 12:59:32 -05:00
ipaPwdExpAdvNotify: 4
Utilize user and group objectclass lists in cn=ipaconfig Change the syntax on user and group objectclasses in cn=ipaconfig
2007-12-06 00:30:26 -05:00
ipaGroupObjectClasses: top
ipaGroupObjectClasses: groupofnames
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 12:17:42 +02:00
ipaGroupObjectClasses: nestedgroup
ipaGroupObjectClasses: ipausergroup
Add a new objectclass, ipaObject, that will add a UUID to many IPA objects ipaObject is defined as an auxiliary objectclass so it is up to the plugin author to ensure that the objectclass is included an a UUID generated. ipaUniqueId is a MUST attribute so if you include the objectclass you must ensure that the uuid is generated. This also fixes up some unrelated unit test failures.
2009-08-10 16:24:10 -04:00
ipaGroupObjectClasses: ipaobject
Utilize user and group objectclass lists in cn=ipaconfig Change the syntax on user and group objectclasses in cn=ipaconfig
2007-12-06 00:30:26 -05:00
ipaUserObjectClasses: top
ipaUserObjectClasses: person
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 12:17:42 +02:00
ipaUserObjectClasses: organizationalperson
ipaUserObjectClasses: inetorgperson
ipaUserObjectClasses: inetuser
ipaUserObjectClasses: posixaccount
ipaUserObjectClasses: krbprincipalaux
Add default values for krb ticket policy attributes during installation.
2010-01-12 16:30:00 +01:00
ipaUserObjectClasses: krbticketpolicyaux
Add a new objectclass, ipaObject, that will add a UUID to many IPA objects ipaObject is defined as an auxiliary objectclass so it is up to the plugin author to ensure that the objectclass is included an a UUID generated. ipaUniqueId is a MUST attribute so if you include the objectclass you must ensure that the uuid is generated. This also fixes up some unrelated unit test failures.
2009-08-10 16:24:10 -04:00
ipaUserObjectClasses: ipaobject
Add default e-mail domain to the IPA configuration
2007-12-10 11:53:00 -05:00
ipaDefaultEmailDomain: $DOMAIN
Add BIND pre-op for DS->IPA password migration to ipa-pwd-extop DS plugin.
2009-09-04 14:51:28 +02:00
ipaMigrationEnabled: FALSE
Add options to control NTLM hashes By default LM hash is disabled. Of course generation still depends on whether the SamAccount objectclass is present in the user object.
2010-10-04 15:13:36 -04:00
ipaConfigString: AllowNThash
Add SELinux user mapping framework. This will allow one to define what SELinux context a given user gets on a given machine. A rule can contain a set of users and hosts or it can point to an existing HBAC rule that defines them. https://fedorahosted.org/freeipa/ticket/755
2011-11-23 16:59:21 -05:00
ipaSELinuxUserMapOrder: guest_u:s0$$xguest_u:s0$$user_u:s0-s0:c0.c1023$$staff_u:s0-s0:c0.c1023$$unconfined_u:s0-s0:c0.c1023
ipaSELinuxUserMapDefault: guest_u:s0
Enable group inactivation by using the Class of Service plugin. This adds 2 new groups: activated and inactivated. If you, or a group you are a member of, is in inactivated then you are too. If you, or a group you are a member of, is in the activated group, then you are too. In a fight between activated and inactivated, activated wins. The DNs for doing this matching is case and white space sensitive. The goal is to never have to actually set nsAccountLock in a user directly but move them between these groups. We need to decide where in the CLI this will happen. Right it is split between ipa-deluser and ipa-usermod. To inactivate groups for now just add the group to inactivate or active.
2007-11-20 22:45:29 -05:00
dn: cn=cosTemplates,cn=accounts,$SUFFIX
Add utility to lock user accounts. Remove lock capability from ipa-deluser Fix bootstrap.ldif to add new Class of Service entries properly Include some man pages that weren't being installed
2007-11-26 22:28:53 -05:00
changetype: add
Enable group inactivation by using the Class of Service plugin. This adds 2 new groups: activated and inactivated. If you, or a group you are a member of, is in inactivated then you are too. If you, or a group you are a member of, is in the activated group, then you are too. In a fight between activated and inactivated, activated wins. The DNs for doing this matching is case and white space sensitive. The goal is to never have to actually set nsAccountLock in a user directly but move them between these groups. We need to decide where in the CLI this will happen. Right it is split between ipa-deluser and ipa-usermod. To inactivate groups for now just add the group to inactivate or active.
2007-11-20 22:45:29 -05:00
objectclass: top
objectclass: nsContainer
cn: cosTemplates
Add support for per-group kerberos password policy. Use a Class of Service template to do per-group password policy. The design calls for non-overlapping groups but with cospriority we can still make sense of things. The password policy entries stored under the REALM are keyed only on the group name because the MIT ldap plugin can't handle quotes in the DN. It also can't handle spaces between elements in the DN.
2009-10-02 09:30:16 -04:00
# templates for this cos definition are managed by the pwpolicy plugin
dn: cn=Password Policy,cn=accounts,$SUFFIX
changetype: add
description: Password Policy based on group membership
objectClass: top
objectClass: ldapsubentry
objectClass: cosSuperDefinition
objectClass: cosClassicDefinition
cosTemplateDn: cn=cosTemplates,cn=accounts,$SUFFIX
Use kerberos password policy. This lets the KDC count password failures and can lock out accounts for a period of time. This only works for KDC >= 1.8. There currently is no way to unlock a locked account across a replica. MIT Kerberos 1.9 is adding support for doing so. Once that is available unlock will be added. The concept of a "global" password policy has changed. When we were managing the policy using the IPA password plugin it was smart enough to search up the tree looking for a policy. The KDC is not so smart and relies on the krbpwdpolicyreference to find the policy. For this reason every user entry requires this attribute. I've created a new global_policy entry to store the default password policy. All users point at this now. The group policy works the same and can override this setting. As a result the special "GLOBAL" name has been replaced with global_policy. This policy works like any other and is the default if a name is not provided on the command-line. ticket 51
2010-10-25 17:58:37 -04:00
cosAttribute: krbPwdPolicyReference override
Add support for per-group kerberos password policy. Use a Class of Service template to do per-group password policy. The design calls for non-overlapping groups but with cospriority we can still make sense of things. The password policy entries stored under the REALM are keyed only on the group name because the MIT ldap plugin can't handle quotes in the DN. It also can't handle spaces between elements in the DN.
2009-10-02 09:30:16 -04:00
cosSpecifier: memberOf
Add SELinux user mapping framework. This will allow one to define what SELinux context a given user gets on a given machine. A rule can contain a set of users and hosts or it can point to an existing HBAC rule that defines them. https://fedorahosted.org/freeipa/ticket/755
2011-11-23 16:59:21 -05:00
dn: cn=selinux,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: selinux
dn: cn=usermap,cn=selinux,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: usermap
Reference in New Issue Copy Permalink