IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-28 01:41:14 -06:00
Code Issues Packages Projects Releases Wiki Activity
69de8b317a
freeipa/install/share/delegation.ldif

754 lines
26 KiB
Plaintext
Raw Normal View History

Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
############################################
# Configure the DIT
############################################
dn: cn=roles,cn=accounts,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: nsContainer
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
cn: roles
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
# Permissions-based Access Control
dn: cn=pbac,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: pbac
dn: cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: nsContainer
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
cn: privileges
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: nsContainer
cn: permissions
############################################
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
# Add the default roles
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
############################################
dn: cn=helpdesk,cn=roles,cn=accounts,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
cn: helpdesk
description: Helpdesk
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
############################################
# Add the default privileges
############################################
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=useradmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
cn: useradmin
description: User Administrators
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=groupadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
cn: groupadmin
description: Group Administrators
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=hostadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
cn: hostadmin
description: Host Administrators
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=hostgroupadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
cn: hostgroupadmin
description: Host Group Administrators
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=delegationadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
cn: delegationadmin
description: Role administration
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=serviceadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
cn: serviceadmin
description: Service Administrators
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=automountadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
cn: automountadmin
description: Automount Administrators
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=netgroupadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
cn: netgroupadmin
description: Netgroups Administrators
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=certadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
objectClass: nestedgroup
cn: certadmin
description: Certificate Administrators
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=replicaadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
objectClass: nestedgroup
cn: replicaadmin
description: Replication Administrators
member: cn=admins,cn=groups,cn=accounts,$SUFFIX
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=enrollhost,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
cn: enrollhost
description: Host Enrollment
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=entitlementadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
cn: entitlementadmin
description: Entitlement Administrators
############################################
# Default permissions.
############################################
# User administration
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=addusers,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: addusers
description: Add Users
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=useradmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=change_password,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: change_password
description: Change a user password
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=useradmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=add_user_to_default_group,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: add_user_to_default_group
description: Add user to default group
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=useradmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=removeusers,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: removeusers
description: Remove Users
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=useradmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=modifyusers,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: modifyusers
description: Modify Users
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=useradmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Group administration
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=addgroups,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: addgroups
description: Add Groups
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=groupadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=removegroups,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: removegroups
description: Remove Groups
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=groupadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=modifygroups,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: modifygroups
description: Modify Groups
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=groupadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=modifygroupmembership,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: modifygroupmembership
description: Modify Group membership
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=groupadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Host administration
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=addhosts,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: addhosts
description: Add Hosts
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=hostadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=removehosts,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: removehosts
description: Remove Hosts
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=hostadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=modifyhosts,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: modifyhosts
description: Modify Hosts
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=hostadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Hostgroup administration
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=addhostgroups,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: addhostgroups
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
description: Add Hostgroups
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=hostgroupadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=removehostgroups,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: removehostgroups
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
description: Remove Hostgroups
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=hostgroupadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=modifyhostgroups,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: modifyhostgroups
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
description: Modify Hostgroups
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=hostgroupadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=modifyhostgroupmembership,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: modifyhostgroupmembership
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
description: Modify Hostgroup membership
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=hostgroupadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Service administration
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=addservices,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: addservices
description: Add Services
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=serviceadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=removeservices,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: removeservices
description: Remove Services
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=serviceadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=modifyservices,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
cn: modifyservices
description: Modify Services
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=serviceadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Delegation administration
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=addroles,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: addroles
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
description: Add Roles
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=delegationadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=removeroles,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: removeroles
description: Remove Roles
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=delegationadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=modifyroles,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: modifyroles
description: Modify Roles
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=delegationadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=modifyrolemembership,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
cn: modifyrolemembership
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
description: Modify Role Group membership
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=delegationadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=modifyprivilegemembership,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: nestedgroup
cn: modifyprivilegemembership
description: Modify privilege membership
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=delegationadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Automount administration
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=addautomountmaps,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
cn: addautomountmaps
description: Add Automount maps
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=automountadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=removeautomountmaps,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
cn: removeautomountmaps
description: Remove Automount maps
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=automountadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=addautomountkeys,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
cn: addautomountkeys
description: Add Automount keys
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=automountadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=removeautomountkeys,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: removeautomountkeys
description: Remove Automount keys
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=automountadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Netgroup administration
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=addnetgroups,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: addnetgroups
description: Add netgroups
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=netgroupadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=removenetgroups,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: removenetgroups
description: Remove netgroups
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=netgroupadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=modifynetgroups,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: modifynetgroups
description: Modify netgroups
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=netgroupadmin,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=modifynetgroupmembership,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: modifynetgroupmembership
description: Modify netgroup membership
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=netgroupadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Keytab access
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=manage_host_keytab,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: manage_host_keytab
description: Manage host keytab
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=hostadmin,cn=privileges,cn=pbac,$SUFFIX
member: cn=enrollhost,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=manage_service_keytab,cn=permissions,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
cn: manage_service_keytab
description: Manage service keytab
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=serviceadmin,cn=privileges,cn=pbac,$SUFFIX
member: cn=admins,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# DNS administration
# The permission and aci for this is in install/updates/dns.ldif
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=enroll_host,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: enroll_host
description: Enroll a host
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=hostadmin,cn=privileges,cn=pbac,$SUFFIX
member: cn=enrollhost,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Replica administration
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=addreplica,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
Remove referrals when removing agreements Part of this fix requires also giving proper permission to change the replication agreements root. While there also fix replica-related permissions to have the classic add/modify/remove triplet of permissions. Fixes: https://fedorahosted.org/freeipa/ticket/630
2010-12-20 09:05:17 -06:00
cn: addreplica
description: Add Replication Agreements
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=replicaadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=modifyreplica,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
Remove referrals when removing agreements Part of this fix requires also giving proper permission to change the replication agreements root. While there also fix replica-related permissions to have the classic add/modify/remove triplet of permissions. Fixes: https://fedorahosted.org/freeipa/ticket/630
2010-12-20 09:05:17 -06:00
cn: modifyreplica
description: Modify Replication Agreements
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=replicaadmin,cn=privileges,cn=pbac,$SUFFIX
Remove referrals when removing agreements Part of this fix requires also giving proper permission to change the replication agreements root. While there also fix replica-related permissions to have the classic add/modify/remove triplet of permissions. Fixes: https://fedorahosted.org/freeipa/ticket/630
2010-12-20 09:05:17 -06:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=removereplica,cn=permissions,cn=pbac,$SUFFIX
Remove referrals when removing agreements Part of this fix requires also giving proper permission to change the replication agreements root. While there also fix replica-related permissions to have the classic add/modify/remove triplet of permissions. Fixes: https://fedorahosted.org/freeipa/ticket/630
2010-12-20 09:05:17 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: removereplica
description: Remove Replication Agreements
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=replicaadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Entitlement management
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=addentitlements,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: addentitlements
description: Add Entitlements
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=entitlementadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=removeentitlements,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: removeentitlements
description: Remove Entitlements
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=entitlementadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=modifyentitlements,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: modifyentitlements
description: Modify Entitlements
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=entitlementadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
############################################
# Default permissions (ACIs)
############################################
# User administration
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "Add Users";allow (add) groupdn = "ldap:///cn=addusers,cn=permissions,cn=pbac,$SUFFIX";)
aci: (target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword || passwordhistory")(version 3.0;acl "Change a user password";allow (write) groupdn = "ldap:///cn=change_password,cn=permissions,cn=pbac,$SUFFIX";)
aci: (targetattr = "member")(target = "ldap:///cn=ipausers,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "Add user to default group";allow (write) groupdn = "ldap:///cn=add_user_to_default_group,cn=permissions,cn=pbac,$SUFFIX";)
aci: (target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "Remove Users";allow (delete) groupdn = "ldap:///cn=removeusers,cn=permissions,cn=pbac,$SUFFIX";)
aci: (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype || businesscategory || ou || mepmanagedentry || objectclass")(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "Modify Users";allow (write) groupdn = "ldap:///cn=modifyusers,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Group administration
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "Add Groups";allow (add) groupdn = "ldap:///cn=addgroups,cn=permissions,cn=pbac,$SUFFIX";)
aci: (targetattr = "member")(target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "Modify group membership";allow (write) groupdn = "ldap:///cn=modifygroupmembership,cn=permissions,cn=pbac,$SUFFIX";)
aci: (target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "Remove Groups";allow (delete) groupdn = "ldap:///cn=removegroups,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# We need objectclass and gidnumber in modify so a non-posix group can be
# promoted. We need mqpManagedBy and ipaUniqueId so a group can be detached.
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (targetattr = "cn || description || gidnumber || objectclass || mepmanagedby || ipauniqueid")(target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "Modify Groups";allow (write) groupdn = "ldap:///cn=modifygroups,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Host administration
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "Add Hosts";allow (add) groupdn = "ldap:///cn=addhosts,cn=permissions,cn=pbac,$SUFFIX";)
aci: (target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "Remove Hosts";allow (delete) groupdn = "ldap:///cn=removehosts,cn=permissions,cn=pbac,$SUFFIX";)
aci: (targetattr = "description || l || nshostlocation || nshardwareplatform || nsosversion")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "Modify Hosts";allow (write) groupdn = "ldap:///cn=modifyhosts,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Hostgroup administration
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (target = "ldap:///cn=*,cn=hostgroups,cn=accounts,$SUFFIX")(version 3.0;acl "Add Hostgroups";allow (add) groupdn = "ldap:///cn=addhostgroups,cn=permissions,cn=pbac,$SUFFIX";)
aci: (target = "ldap:///cn=*,cn=hostgroups,cn=accounts,$SUFFIX")(version 3.0;acl "Remove Hostgroups";allow (delete) groupdn = "ldap:///cn=removehostgroups,cn=permissions,cn=pbac,$SUFFIX";)
aci: (targetattr = "cn || description")(target = "ldap:///cn=*,cn=hostgroups,cn=accounts,$SUFFIX")(version 3.0; acl "Modify Hostgroups";allow (write) groupdn = "ldap:///cn=modifyhostgroups,cn=permissions,cn=pbac,$SUFFIX";)
aci: (targetattr = "member")(target = "ldap:///cn=*,cn=hostgroups,cn=accounts,$SUFFIX")(version 3.0;acl "Modify Hostgroup membership";allow (write) groupdn = "ldap:///cn=modifyhostgroupmembership,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Service administration
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,$SUFFIX")(version 3.0;acl "Add Services";allow (add) groupdn = "ldap:///cn=addservices,cn=permissions,cn=pbac,$SUFFIX";)
aci: (target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,$SUFFIX")(version 3.0;acl "Remove Services";allow (delete) groupdn = "ldap:///cn=removeservices,cn=permissions,cn=pbac,$SUFFIX";)
aci: (targetattr = "usercertificate")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,$SUFFIX")(version 3.0;acl "Modify Services";allow (write) groupdn = "ldap:///cn=modifyservices,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Delegation administration
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (target = "ldap:///cn=*,cn=roles,cn=accounts,$SUFFIX")(version 3.0;acl "Add Roles";allow (add) groupdn = "ldap:///cn=addroles,cn=permissions,cn=pbac,$SUFFIX";)
aci: (target = "ldap:///cn=*,cn=roles,cn=accounts,$SUFFIX")(version 3.0;acl "Remove Roles";allow (delete) groupdn = "ldap:///cn=removeroles,cn=permissions,cn=pbac,$SUFFIX";)
aci: (targetattr = "cn || description")(target = "ldap:///cn=*,cn=roles,cn=accounts,$SUFFIX")(version 3.0; acl "Modify Roles";allow (write) groupdn = "ldap:///cn=modifyroles,cn=permissions,cn=pbac,$SUFFIX";)
aci: (targetattr = "member")(target = "ldap:///cn=*,cn=roles,cn=accounts,$SUFFIX")(version 3.0;acl "Modify role group membership";allow (write) groupdn = "ldap:///cn=modifyrolemembership,cn=permissions,cn=pbac,$SUFFIX";)
aci: (targetattr = "member")(target = "ldap:///cn=*,cn=permissions,cn=pbac,$SUFFIX")(version 3.0;acl "Modify privilege membership";allow (write) groupdn = "ldap:///cn=modifyprivilegemembership,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Automount administration
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (target = "ldap:///automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "Add Automount maps";allow (add) groupdn = "ldap:///cn=addautomountmaps,cn=permissions,cn=pbac,$SUFFIX";)
aci: (target = "ldap:///automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "Remove automount maps";allow (delete) groupdn = "ldap:///cn=removeautomountmaps,cn=permissions,cn=pbac,$SUFFIX";)
aci: (target = "ldap:///automountkey=*,automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "Add automount keys";allow (add) groupdn = "ldap:///cn=addautomountkeys,cn=permissions,cn=pbac,$SUFFIX";)
aci: (target = "ldap:///automountkey=*,automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "Remove automount keys";allow (delete) groupdn = "ldap:///cn=removeautomountkeys,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Netgroup administration
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (target = "ldap:///ipauniqueid=*,cn=ng,cn=alt,$SUFFIX")(version 3.0;acl "Add netgroups";allow (add) groupdn = "ldap:///cn=addnetgroups,cn=permissions,cn=pbac,$SUFFIX";)
aci: (target = "ldap:///ipauniqueid=*,cn=ng,cn=alt,$SUFFIX")(version 3.0;acl "Remove netgroups";allow (delete) groupdn = "ldap:///cn=removenetgroups,cn=permissions,cn=pbac,$SUFFIX";)
aci: (targetattr = "description")(target = "ldap:///ipauniqueid=*,cn=ng,cn=alt,$SUFFIX")(version 3.0; acl "Modify netgroups";allow (write) groupdn = "ldap:///cn=modifynetgroups,cn=permissions,cn=pbac,$SUFFIX";)
aci: (targetattr = "memberhost || externalhost || memberuser || member")(target = "ldap:///ipauniqueid=*,cn=ng,cn=alt,$SUFFIX")(version 3.0;acl "Modify netgroup membership";allow (write) groupdn = "ldap:///cn=modifynetgroupmembership,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Host keytab admin
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (targetattr = "krbprincipalkey || krblastpwdchange")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "Manage host keytab";allow (write) groupdn = "ldap:///cn=manage_host_keytab,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Service keytab admin
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (targetattr = "krbprincipalkey || krblastpwdchange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,$SUFFIX")(version 3.0;acl "Manage service keytab";allow (write) groupdn = "ldap:///cn=manage_service_keytab,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Add the ACI needed to do host enrollment. When this occurs we
# set the krbPrincipalName, add krbPrincipalAux to objectClass and
# set enrolledBy to whoever ran join.
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (targetattr = "enrolledby || objectclass")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "Enroll a host";allow (write) groupdn = "ldap:///cn=enroll_host,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Entitlement administration
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (target = "ldap:///ipauniqueid=*,cn=entitlements,cn=etc,$SUFFIX")(version 3.0;acl "Add Entitlements";allow (add) groupdn = "ldap:///cn=addentitlements,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (targetattr = "usercertificate")(target = "ldap:///ipauniqueid=*,cn=entitlements,cn=etc,$SUFFIX")(version 3.0;acl "Modify Entitlements";allow (write) groupdn = "ldap:///cn=modifyentitlements,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (target = "ldap:///ipauniqueid=*,cn=entitlements,cn=etc,$SUFFIX")(version 3.0;acl "Remove Entitlements";allow (delete) groupdn = "ldap:///cn=removeentitlements,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Create virtual operations entry. This is used to control access to
# operations that don't rely on LDAP directly.
dn: cn=virtual operations,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: virtual operations
# Retrieve Certificate virtual op
dn: cn=retrieve certificate,cn=virtual operations,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: retrieve certificate
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=retrieve_certs,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: retrieve_certs
description: Retrieve Certificates from the CA
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=certadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,$SUFFIX" )(version 3.0 ; acl "Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=retrieve_certs,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Request Certificate virtual op
dn: cn=request certificate,cn=virtual operations,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: request certificate
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=request_certs,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: request_certs
description: Request Certificates from the CA
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=certadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,$SUFFIX" )(version 3.0 ; acl "Request Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=request_certs,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Request Certificate from different host virtual op
dn: cn=request certificate different host,cn=virtual operations,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: request certificate different host
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=request_cert_different_host,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: request_cert_different_host
description: Request Certificates from a different host
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=certadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,$SUFFIX" )(version 3.0 ; acl "Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=request_cert_different_host,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Certificate Status virtual op
dn: cn=certificate status,cn=virtual operations,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: certificate status
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=certificate_status,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: certificate_status
description: Get Certificates status from the CA
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=certadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,$SUFFIX" )(version 3.0 ; acl "Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=certificate_status,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Revoke Certificate virtual op
dn: cn=revoke certificate,cn=virtual operations,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: revoke certificate
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=revoke_certificate,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: revoke_certificate
description: Revoke Certificate
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=certadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,$SUFFIX" )(version 3.0 ; acl "Revoke Certificate"; allow (write) groupdn = "ldap:///cn=revoke_certificate,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Certificate Remove Hold virtual op
dn: cn=certificate remove hold,cn=virtual operations,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: certificate remove hold
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=certificate_remove_hold,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
cn: certificate_remove_hold
description: Certificate Remove Hold
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
member: cn=certadmin,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,$SUFFIX" )(version 3.0 ; acl "Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=certificate_remove_hold,cn=permissions,cn=pbac,$SUFFIX";)
Reference in New Issue Copy Permalink