IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-26 00:41:25 -06:00
Code Issues Packages Projects Releases Wiki Activity
7c2eb48850
freeipa/install/share/bootstrap-template.ldif

431 lines
9.4 KiB
Plaintext
Raw Normal View History

Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=accounts,$SUFFIX
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested!
2007-06-28 18:09:54 -05:00
changetype: add
import initial install tool
0000-12-31 18:09:24 -05:50
objectClass: top
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
objectClass: nsContainer
cn: accounts
import initial install tool
0000-12-31 18:09:24 -05:50
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=users,cn=accounts,$SUFFIX
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested!
2007-06-28 18:09:54 -05:00
changetype: add
import initial install tool
0000-12-31 18:09:24 -05:50
objectClass: top
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
objectClass: nsContainer
cn: users
import initial install tool
0000-12-31 18:09:24 -05:50
More DIT fixes discovered after testing
2007-08-31 17:36:54 -05:00
dn: cn=groups,cn=accounts,$SUFFIX
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested!
2007-06-28 18:09:54 -05:00
changetype: add
import initial install tool
0000-12-31 18:09:24 -05:50
objectClass: top
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
objectClass: nsContainer
cn: groups
import initial install tool
0000-12-31 18:09:24 -05:50
Add xml-rpc interface for getting keytabs. Warning: this lacks any sort of authorization.
0000-12-31 18:09:24 -05:50
dn: cn=services,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: services
import initial install tool
0000-12-31 18:09:24 -05:50
minor typos
2007-11-30 15:58:02 -06:00
dn: cn=computers,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: computers
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
dn: cn=hostgroups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: hostgroups
dn: cn=alt,$SUFFIX
changetype: add
objectClass: nsContainer
cn: alt
dn: cn=ng,cn=alt,$SUFFIX
changetype: add
objectClass: nsContainer
cn: ng
dn: cn=automount,$SUFFIX
changetype: add
objectClass: nsContainer
cn: automount
dn: cn=default,cn=automount,$SUFFIX
changetype: add
objectClass: nsContainer
cn: default
dn: automountmapname=auto.master,cn=default,cn=automount,$SUFFIX
changetype: add
objectClass: automountMap
automountMapName: auto.master
dn: automountmapname=auto.direct,cn=default,cn=automount,$SUFFIX
changetype: add
objectClass: automountMap
automountMapName: auto.direct
Enforce uniqueness on (key,info) pairs in automount keys https://fedorahosted.org/freeipa/ticket/293
2010-12-19 13:23:16 -06:00
dn: description=/- auto.direct,automountmapname=auto.master,cn=default,cn=automount,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectClass: automount
automountKey: /-
automountInformation: auto.direct
Enforce uniqueness on (key,info) pairs in automount keys https://fedorahosted.org/freeipa/ticket/293
2010-12-19 13:23:16 -06:00
description: /- auto.direct
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=hbac,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: hbac
dn: cn=hbacservices,cn=hbac,$SUFFIX
Add groups of services to HBAC Replace serviceName with memberService so we can assign individual services or groups of services to an HBAC rule. 588574
2010-05-14 08:37:54 -05:00
changetype: add
objectClass: top
objectClass: nsContainer
cn: hbacservices
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=hbacservicegroups,cn=hbac,$SUFFIX
Add groups of services to HBAC Replace serviceName with memberService so we can assign individual services or groups of services to an HBAC rule. 588574
2010-05-14 08:37:54 -05:00
changetype: add
objectClass: top
objectClass: nsContainer
cn: hbacservicegroups
Move sudo related data all under cn=sudo Fixes: https://fedorahosted.org/freeipa/ticket/773
2011-01-14 14:27:56 -06:00
dn: cn=sudo,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: sudo
dn: cn=sudocmds,cn=sudo,$SUFFIX
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
changetype: add
objectClass: top
objectClass: nsContainer
cn: sudocmds
Move sudo related data all under cn=sudo Fixes: https://fedorahosted.org/freeipa/ticket/773
2011-01-14 14:27:56 -06:00
dn: cn=sudocmdgroups,cn=sudo,$SUFFIX
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
changetype: add
objectClass: top
objectClass: nsContainer
cn: sudocmdgroups
Move sudo related data all under cn=sudo Fixes: https://fedorahosted.org/freeipa/ticket/773
2011-01-14 14:27:56 -06:00
dn: cn=sudorules,cn=sudo,$SUFFIX
Add HBAC plugin and introduce GeneralizedTime parameter type.
2009-09-30 09:24:25 -05:00
changetype: add
objectClass: top
objectClass: nsContainer
Move sudo related data all under cn=sudo Fixes: https://fedorahosted.org/freeipa/ticket/773
2011-01-14 14:27:56 -06:00
cn: sudorules
Add HBAC plugin and introduce GeneralizedTime parameter type.
2009-09-30 09:24:25 -05:00
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=etc,$SUFFIX
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
changetype: add
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
objectClass: nsContainer
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
objectClass: top
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
cn: etc
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=sysaccounts,cn=etc,$SUFFIX
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
changetype: add
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
objectClass: nsContainer
objectClass: top
cn: sysaccounts
Add container and initial ACIs for entitlement support The entitlement entries themselves will be rather simple, consisting of the objectClasses ipaObject and pkiUser. We will just store userCertificate in it. The DN will contain the UUID of the entitlement. ticket #27
2010-07-21 14:44:49 -05:00
dn: cn=entitlements,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: entitlements
Add posix auto gen for single master case
2007-11-06 17:57:15 -06:00
dn: cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: ipa
dn: cn=masters,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: masters
Store list of non-master replicas in DIT and provide way to list them Fixes: https://fedorahosted.org/freeipa/ticket/1007
2011-02-28 16:35:44 -06:00
dn: cn=replicas,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: replicas
id ranges: change DNA configuration Change the way we specify the id ranges to force uid and gid ranges to always be the same. Add option to specify a maximum id. Change DNA configuration to use shared ranges so that masters and replicas can actually share the same overall range in a safe way. Configure replicas so that their default range is depleted. This will force them to fetch a range portion from the master on the first install. fixes: https://fedorahosted.org/freeipa/ticket/198
2010-11-11 17:15:28 -06:00
dn: cn=dna,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: dna
dn: cn=posix-ids,cn=dna,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: posix-ids
Use certmonger to renew CA subsystem certificates Certificate renewal can be done only one one CA as the certificates need to be shared amongst them. certmonger has been trained to communicate directly with dogtag to perform the renewals. The initial CA installation is the defacto certificate renewal master. A copy of the certificate is stored in the IPA LDAP tree in cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX, the rdn being the nickname of the certificate, when a certificate is renewed. Only the most current certificate is stored. It is valid to have no certificates there, it means that no renewals have taken place. The clones are configured with a new certmonger CA type that polls this location in the IPA tree looking for an updated certificate. If one is not found then certmonger is put into the CA_WORKING state and will poll every 8 hours until an updated certificate is available. The RA agent certificate, ipaCert in /etc/httpd/alias, is a special case. When this certificate is updated we also need to update its entry in the dogtag tree, adding the updated certificate and telling dogtag which certificate to use. This is the certificate that lets IPA issue certificates. On upgrades we check to see if the certificate tracking is already in place. If not then we need to determine if this is the master that will do the renewals or not. This decision is made based on whether it was the first master installed. It is concievable that this master is no longer available meaning that none are actually tracking renewal. We will need to document this. https://fedorahosted.org/freeipa/ticket/2803
2012-07-11 14:51:01 -05:00
dn: cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: ca_renewal
Configure s4u2proxy during installation. This creates a new container, cn=s4u2proxy,cn=etc,$SUFFIX Within that container we control which services are allowed to delegate tickets for other services. Right now that is limited from the IPA HTTP to ldap services. Requires a version of mod_auth_kerb that supports s4u2proxy https://fedorahosted.org/freeipa/ticket/1098
2012-01-10 21:39:26 -06:00
dn: cn=s4u2proxy,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: s4u2proxy
dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
changetype: add
objectClass: ipaKrb5DelegationACL
objectClass: groupOfPrincipals
objectClass: top
cn: ipa-http-delegation
memberPrincipal: HTTP/$HOST@$REALM
Don't set delegation flag in client, we're using S4U2Proxy now A forwardable ticket is still required but we no longer need to send the TGT to the IPA server. A new flag, --delegate, is available if the old behavior is required. Set the minimum n-v-r for mod_auth_kerb and krb5-server to pick up needed patches for S4U2Proxy to work. https://fedorahosted.org/freeipa/ticket/1098 https://fedorahosted.org/freeipa/ticket/2246
2012-02-15 10:06:54 -06:00
ipaAllowedTarget: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
Add separate attribute to store trusted domain SID We need two attributes in the ipaNTTrustedDomain objectclass to store different kind of SID. Currently ipaNTSecurityIdentifier is used to store the Domain-SID of the trusted domain. A second attribute is needed to store the SID for the trusted domain user. Since it cannot be derived safely from other values and since it does not make sense to create a separate object for the user a new attribute is needed. https://fedorahosted.org/freeipa/ticket/2191
2012-02-28 05:22:49 -06:00
ipaAllowedTarget: cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
Configure s4u2proxy during installation. This creates a new container, cn=s4u2proxy,cn=etc,$SUFFIX Within that container we control which services are allowed to delegate tickets for other services. Right now that is limited from the IPA HTTP to ldap services. Requires a version of mod_auth_kerb that supports s4u2proxy https://fedorahosted.org/freeipa/ticket/1098
2012-01-10 21:39:26 -06:00
dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
changetype: add
objectClass: groupOfPrincipals
objectClass: top
cn: ipa-ldap-delegation-targets
memberPrincipal: ldap/$HOST@$REALM
Add separate attribute to store trusted domain SID We need two attributes in the ipaNTTrustedDomain objectclass to store different kind of SID. Currently ipaNTSecurityIdentifier is used to store the Domain-SID of the trusted domain. A second attribute is needed to store the SID for the trusted domain user. Since it cannot be derived safely from other values and since it does not make sense to create a separate object for the user a new attribute is needed. https://fedorahosted.org/freeipa/ticket/2191
2012-02-28 05:22:49 -06:00
dn: cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
changetype: add
objectClass: groupOfPrincipals
objectClass: top
cn: ipa-cifs-delegation-targets
Move admin into cn=users,cn=accounts After some deep thinking I think the advantages of keeping all posix enabled user accounts under cn=users,cn=accounts overweight a perceived better protection of the admin account by keeping it in a separate tree.
2008-05-22 16:55:27 -05:00
dn: uid=admin,cn=users,cn=accounts,$SUFFIX
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
changetype: add
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
objectClass: top
objectClass: person
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
objectClass: posixaccount
objectClass: krbprincipalaux
Add default values for krb ticket policy attributes during installation.
2010-01-12 09:30:00 -06:00
objectClass: krbticketpolicyaux
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
objectClass: inetuser
UUIDs: remove uuid python plugin and let DS always autogenerate merge in remove uuid
2010-10-26 09:26:06 -05:00
objectClass: ipaobject
Add LDAP schema for SSH public keys. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:46:23 -06:00
objectClass: ipasshuser
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
uid: admin
krbPrincipalName: admin@$REALM
cn: Administrator
sn: Administrator
id ranges: change DNA configuration Change the way we specify the id ranges to force uid and gid ranges to always be the same. Add option to specify a maximum id. Change DNA configuration to use shared ranges so that masters and replicas can actually share the same overall range in a safe way. Configure replicas so that their default range is depleted. This will force them to fetch a range portion from the master on the first install. fixes: https://fedorahosted.org/freeipa/ticket/198
2010-11-11 17:15:28 -06:00
uidNumber: $IDSTART
gidNumber: $IDSTART
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
homeDirectory: /home/admin
loginShell: /bin/bash
gecos: Administrator
install: Use proper case for boolean values
2011-07-20 14:44:26 -05:00
nsAccountLock: FALSE
UUIDs: remove uuid python plugin and let DS always autogenerate merge in remove uuid
2010-10-26 09:26:06 -05:00
ipaUniqueID: autogenerate
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=admins,cn=groups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
Use groupOfNames and member, not groupOfUniqueNames and uniqueMember
2007-11-20 09:22:43 -06:00
objectClass: groupofnames
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
objectClass: posixgroup
Add ipaUserGroup objectClass to default groups where missing.
2009-12-01 06:41:47 -06:00
objectClass: ipausergroup
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 13:37:45 -05:00
objectClass: ipaobject
patch queue: admin_account_fix.patch
2007-10-04 15:41:19 -05:00
cn: admins
Integrate corrections pointed out on the list
2007-08-30 11:23:39 -05:00
description: Account administrators group
id ranges: change DNA configuration Change the way we specify the id ranges to force uid and gid ranges to always be the same. Add option to specify a maximum id. Change DNA configuration to use shared ranges so that masters and replicas can actually share the same overall range in a safe way. Configure replicas so that their default range is depleted. This will force them to fetch a range portion from the master on the first install. fixes: https://fedorahosted.org/freeipa/ticket/198
2010-11-11 17:15:28 -06:00
gidNumber: $IDSTART
Move admin into cn=users,cn=accounts After some deep thinking I think the advantages of keeping all posix enabled user accounts under cn=users,cn=accounts overweight a perceived better protection of the admin account by keeping it in a separate tree.
2008-05-22 16:55:27 -05:00
member: uid=admin,cn=users,cn=accounts,$SUFFIX
install: Use proper case for boolean values
2011-07-20 14:44:26 -05:00
nsAccountLock: FALSE
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 13:37:45 -05:00
ipaUniqueID: autogenerate
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=ipausers,cn=groups,cn=accounts,$SUFFIX
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
changetype: add
objectClass: top
Use groupOfNames and member, not groupOfUniqueNames and uniqueMember
2007-11-20 09:22:43 -06:00
objectClass: groupofnames
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
objectClass: nestedgroup
objectClass: ipausergroup
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 13:37:45 -05:00
objectClass: ipaobject
Add an editors group. This is used to generally grant access for users to edit other users (the Edit link won't appear otherwise). Additional delegation is need to grant permission to individual attributes. Update the failed login page to indicate that it is a permission issue. Don't allow access to policy at all for non-admins. By default users can only edit themselves.
2007-11-14 09:49:03 -06:00
description: Default group for all users
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
cn: ipausers
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 13:37:45 -05:00
ipaUniqueID: autogenerate
Add an editors group. This is used to generally grant access for users to edit other users (the Edit link won't appear otherwise). Additional delegation is need to grant permission to individual attributes. Update the failed login page to indicate that it is a permission issue. Don't allow access to policy at all for non-admins. By default users can only edit themselves.
2007-11-14 09:49:03 -06:00
dn: cn=editors,cn=groups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
Use groupOfNames and member, not groupOfUniqueNames and uniqueMember
2007-11-20 09:22:43 -06:00
objectClass: groupofnames
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
objectClass: posixgroup
Add ipaUserGroup objectClass to default groups where missing.
2009-12-01 06:41:47 -06:00
objectClass: ipausergroup
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 13:37:45 -05:00
objectClass: ipaobject
id ranges: change DNA configuration Change the way we specify the id ranges to force uid and gid ranges to always be the same. Add option to specify a maximum id. Change DNA configuration to use shared ranges so that masters and replicas can actually share the same overall range in a safe way. Configure replicas so that their default range is depleted. This will force them to fetch a range portion from the master on the first install. fixes: https://fedorahosted.org/freeipa/ticket/198
2010-11-11 17:15:28 -06:00
gidNumber: eval($IDSTART+2)
Add an editors group. This is used to generally grant access for users to edit other users (the Edit link won't appear otherwise). Additional delegation is need to grant permission to individual attributes. Update the failed login page to indicate that it is a permission issue. Don't allow access to policy at all for non-admins. By default users can only edit themselves.
2007-11-14 09:49:03 -06:00
description: Limited admins who can edit other users
cn: editors
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 13:37:45 -05:00
ipaUniqueID: autogenerate
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 11:59:32 -06:00
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=sshd,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: sshd
description: sshd
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=ftp,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: ftp
description: ftp
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=su,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: su
description: su
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=login,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: login
description: login
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=su-l,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: su-l
description: su with login shell
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=sudo,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: sudo
description: sudo
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=sudo-i,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: sudo-i
description: sudo-i
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=gdm,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: gdm
description: gdm
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=gdm-password,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: gdm-password
description: gdm-password
ipauniqueid:autogenerate
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
dn: cn=kdm,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectclass: ipahbacservice
objectclass: ipaobject
cn: kdm
description: kdm
ipauniqueid:autogenerate
Use Sudo rather than SUDO as a label. ticket 1005
2011-02-28 10:44:27 -06:00
dn: cn=Sudo,cn=hbacservicegroups,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
changetype: add
objectClass: ipaobject
objectClass: ipahbacservicegroup
objectClass: nestedGroup
objectClass: groupOfNames
objectClass: top
Use Sudo rather than SUDO as a label. ticket 1005
2011-02-28 10:44:27 -06:00
cn: Sudo
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
ipauniqueid:autogenerate
Use Sudo rather than SUDO as a label. ticket 1005
2011-02-28 10:44:27 -06:00
description: Default group of Sudo related services
Move HBAC services and service groups to cn=hbac https://fedorahosted.org/freeipa/ticket/762
2011-01-18 03:56:17 -06:00
member: cn=sudo,cn=hbacservices,cn=hbac,$SUFFIX
member: cn=sudo-i,cn=hbacservices,cn=hbac,$SUFFIX
Move automount, default HBAC services, netgroup and hostgroup bootstrapping. There is no need for these to be done as updates, just add these entries to the bootstrapping.
2010-12-13 12:23:04 -06:00
Minor fixes.
0000-12-31 18:09:24 -05:50
dn: cn=ipaConfig,cn=etc,$SUFFIX
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 11:59:32 -06:00
changetype: add
objectClass: nsContainer
objectClass: top
objectClass: ipaGuiConfig
Add options to control NTLM hashes By default LM hash is disabled. Of course generation still depends on whether the SamAccount objectclass is present in the user object.
2010-10-04 14:13:36 -05:00
objectClass: ipaConfigObject
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
ipaUserSearchFields: uid,givenname,sn,telephonenumber,ou,title
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 11:59:32 -06:00
ipaGroupSearchFields: cn,description
ipaSearchTimeLimit: 2
Default search limit to 100
2010-10-18 16:07:01 -05:00
ipaSearchRecordsLimit: 100
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 11:59:32 -06:00
ipaHomesRootDir: /home
ipaDefaultLoginShell: /bin/sh
ipaDefaultPrimaryGroup: ipausers
Increase # of chars in users and groups to 255 and default username to 32. ticket 434
2010-11-10 16:30:01 -06:00
ipaMaxUsernameLength: 32
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 11:59:32 -06:00
ipaPwdExpAdvNotify: 4
Utilize user and group objectclass lists in cn=ipaconfig Change the syntax on user and group objectclasses in cn=ipaconfig
2007-12-05 23:30:26 -06:00
ipaGroupObjectClasses: top
ipaGroupObjectClasses: groupofnames
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
ipaGroupObjectClasses: nestedgroup
ipaGroupObjectClasses: ipausergroup
Add a new objectclass, ipaObject, that will add a UUID to many IPA objects ipaObject is defined as an auxiliary objectclass so it is up to the plugin author to ensure that the objectclass is included an a UUID generated. ipaUniqueId is a MUST attribute so if you include the objectclass you must ensure that the uuid is generated. This also fixes up some unrelated unit test failures.
2009-08-10 15:24:10 -05:00
ipaGroupObjectClasses: ipaobject
Utilize user and group objectclass lists in cn=ipaconfig Change the syntax on user and group objectclasses in cn=ipaconfig
2007-12-05 23:30:26 -06:00
ipaUserObjectClasses: top
ipaUserObjectClasses: person
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
ipaUserObjectClasses: organizationalperson
ipaUserObjectClasses: inetorgperson
ipaUserObjectClasses: inetuser
ipaUserObjectClasses: posixaccount
ipaUserObjectClasses: krbprincipalaux
Add default values for krb ticket policy attributes during installation.
2010-01-12 09:30:00 -06:00
ipaUserObjectClasses: krbticketpolicyaux
Add a new objectclass, ipaObject, that will add a UUID to many IPA objects ipaObject is defined as an auxiliary objectclass so it is up to the plugin author to ensure that the objectclass is included an a UUID generated. ipaUniqueId is a MUST attribute so if you include the objectclass you must ensure that the uuid is generated. This also fixes up some unrelated unit test failures.
2009-08-10 15:24:10 -05:00
ipaUserObjectClasses: ipaobject
Add LDAP schema for SSH public keys. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:46:23 -06:00
ipaUserObjectClasses: ipasshuser
Add default e-mail domain to the IPA configuration
2007-12-10 10:53:00 -06:00
ipaDefaultEmailDomain: $DOMAIN
Add BIND pre-op for DS->IPA password migration to ipa-pwd-extop DS plugin.
2009-09-04 07:51:28 -05:00
ipaMigrationEnabled: FALSE
Add options to control NTLM hashes By default LM hash is disabled. Of course generation still depends on whether the SamAccount objectclass is present in the user object.
2010-10-04 14:13:36 -05:00
ipaConfigString: AllowNThash
Set MLS/MCS for user_u context to what will be on remote systems. The user_u context in the default list was broader than is actually configured by default on systems. https://fedorahosted.org/freeipa/ticket/3224
2012-11-01 09:13:01 -05:00
ipaSELinuxUserMapOrder: guest_u:s0$$xguest_u:s0$$user_u:s0$$staff_u:s0-s0:c0.c1023$$unconfined_u:s0-s0:c0.c1023
Set SELinux default context to unconfined_u:s0-s0:c0.c1023 Don't require ipaselinuxdefaultuser to be set. If this is unset then SSSD will use the system default. https://fedorahosted.org/freeipa/ticket/3045
2012-09-10 16:07:54 -05:00
ipaSELinuxUserMapDefault: unconfined_u:s0-s0:c0.c1023
Enable group inactivation by using the Class of Service plugin. This adds 2 new groups: activated and inactivated. If you, or a group you are a member of, is in inactivated then you are too. If you, or a group you are a member of, is in the activated group, then you are too. In a fight between activated and inactivated, activated wins. The DNs for doing this matching is case and white space sensitive. The goal is to never have to actually set nsAccountLock in a user directly but move them between these groups. We need to decide where in the CLI this will happen. Right it is split between ipa-deluser and ipa-usermod. To inactivate groups for now just add the group to inactivate or active.
2007-11-20 21:45:29 -06:00
dn: cn=cosTemplates,cn=accounts,$SUFFIX
Add utility to lock user accounts. Remove lock capability from ipa-deluser Fix bootstrap.ldif to add new Class of Service entries properly Include some man pages that weren't being installed
2007-11-26 21:28:53 -06:00
changetype: add
Enable group inactivation by using the Class of Service plugin. This adds 2 new groups: activated and inactivated. If you, or a group you are a member of, is in inactivated then you are too. If you, or a group you are a member of, is in the activated group, then you are too. In a fight between activated and inactivated, activated wins. The DNs for doing this matching is case and white space sensitive. The goal is to never have to actually set nsAccountLock in a user directly but move them between these groups. We need to decide where in the CLI this will happen. Right it is split between ipa-deluser and ipa-usermod. To inactivate groups for now just add the group to inactivate or active.
2007-11-20 21:45:29 -06:00
objectclass: top
objectclass: nsContainer
cn: cosTemplates
Add support for per-group kerberos password policy. Use a Class of Service template to do per-group password policy. The design calls for non-overlapping groups but with cospriority we can still make sense of things. The password policy entries stored under the REALM are keyed only on the group name because the MIT ldap plugin can't handle quotes in the DN. It also can't handle spaces between elements in the DN.
2009-10-02 08:30:16 -05:00
# templates for this cos definition are managed by the pwpolicy plugin
dn: cn=Password Policy,cn=accounts,$SUFFIX
changetype: add
description: Password Policy based on group membership
objectClass: top
objectClass: ldapsubentry
objectClass: cosSuperDefinition
objectClass: cosClassicDefinition
cosTemplateDn: cn=cosTemplates,cn=accounts,$SUFFIX
Use kerberos password policy. This lets the KDC count password failures and can lock out accounts for a period of time. This only works for KDC >= 1.8. There currently is no way to unlock a locked account across a replica. MIT Kerberos 1.9 is adding support for doing so. Once that is available unlock will be added. The concept of a "global" password policy has changed. When we were managing the policy using the IPA password plugin it was smart enough to search up the tree looking for a policy. The KDC is not so smart and relies on the krbpwdpolicyreference to find the policy. For this reason every user entry requires this attribute. I've created a new global_policy entry to store the default password policy. All users point at this now. The group policy works the same and can override this setting. As a result the special "GLOBAL" name has been replaced with global_policy. This policy works like any other and is the default if a name is not provided on the command-line. ticket 51
2010-10-25 16:58:37 -05:00
cosAttribute: krbPwdPolicyReference override
Add support for per-group kerberos password policy. Use a Class of Service template to do per-group password policy. The design calls for non-overlapping groups but with cospriority we can still make sense of things. The password policy entries stored under the REALM are keyed only on the group name because the MIT ldap plugin can't handle quotes in the DN. It also can't handle spaces between elements in the DN.
2009-10-02 08:30:16 -05:00
cosSpecifier: memberOf
Add SELinux user mapping framework. This will allow one to define what SELinux context a given user gets on a given machine. A rule can contain a set of users and hosts or it can point to an existing HBAC rule that defines them. https://fedorahosted.org/freeipa/ticket/755
2011-11-23 15:59:21 -06:00
dn: cn=selinux,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: selinux
dn: cn=usermap,cn=selinux,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: usermap
Add objects for initial ID range
2012-06-12 04:58:41 -05:00
dn: cn=ranges,cn=etc,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: ranges
Create default range entry after upgrade Create default range both on new install and on upgrades. Also make sure that all range object classes are present for upgraded machines. Default range LDIF entry for new install was fixed so that new installation does not crash. https://fedorahosted.org/freeipa/ticket/2891
2012-07-02 07:07:01 -05:00
dn: cn=${REALM}_id_range,cn=ranges,cn=etc,$SUFFIX
Add objects for initial ID range
2012-06-12 04:58:41 -05:00
changetype: add
objectClass: top
objectClass: ipaIDrange
objectClass: ipaDomainIDRange
Create default range entry after upgrade Create default range both on new install and on upgrades. Also make sure that all range object classes are present for upgraded machines. Default range LDIF entry for new install was fixed so that new installation does not crash. https://fedorahosted.org/freeipa/ticket/2891
2012-07-02 07:07:01 -05:00
cn: ${REALM}_id_range
Add objects for initial ID range
2012-06-12 04:58:41 -05:00
ipaBaseID: $IDSTART
ipaIDRangeSize: $IDRANGE_SIZE
Reference in New Issue Copy Permalink