IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-27 09:21:59 -06:00
Code Issues Packages Projects Releases Wiki Activity
ae65c01932
freeipa/install/share/dns.ldif

56 lines
2.4 KiB
Plaintext
Raw Normal View History

Use LDAP instead of flat file for zone storage
2009-05-12 08:20:24 -05:00
dn: cn=dns,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: dns
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=add dns entries,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
Fix the change_password permissions and the DNS access controls. The change_password permission was too broad, limit it to users. The DNS access controls rolled everything into a single ACI. I broke it out into separate ACIs for add, delete and add. I also added a new dns type for the permission plugin. ticket 628
2010-12-17 14:04:47 -06:00
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: top
Fix the change_password permissions and the DNS access controls. The change_password permission was too broad, limit it to users. The DNS access controls rolled everything into a single ACI. I broke it out into separate ACIs for add, delete and add. I also added a new dns type for the permission plugin. ticket 628
2010-12-17 14:04:47 -06:00
cn: add dns entries
description: Add DNS entries
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
member: cn=DNS Administrators,cn=privileges,cn=pbac,$SUFFIX
member: cn=DNS Servers,cn=privileges,cn=pbac,$SUFFIX
Fix the change_password permissions and the DNS access controls. The change_password permission was too broad, limit it to users. The DNS access controls rolled everything into a single ACI. I broke it out into separate ACIs for add, delete and add. I also added a new dns type for the permission plugin. ticket 628
2010-12-17 14:04:47 -06:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=remove dns entries,cn=permissions,cn=pbac,$SUFFIX
Fix the change_password permissions and the DNS access controls. The change_password permission was too broad, limit it to users. The DNS access controls rolled everything into a single ACI. I broke it out into separate ACIs for add, delete and add. I also added a new dns type for the permission plugin. ticket 628
2010-12-17 14:04:47 -06:00
changetype: add
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: groupofnames
Fix the change_password permissions and the DNS access controls. The change_password permission was too broad, limit it to users. The DNS access controls rolled everything into a single ACI. I broke it out into separate ACIs for add, delete and add. I also added a new dns type for the permission plugin. ticket 628
2010-12-17 14:04:47 -06:00
objectClass: top
cn: remove dns entries
description: Remove DNS entries
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
member: cn=DNS Administrators,cn=privileges,cn=pbac,$SUFFIX
member: cn=DNS Servers,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=update dns entries,cn=permissions,cn=pbac,$SUFFIX
Fix the change_password permissions and the DNS access controls. The change_password permission was too broad, limit it to users. The DNS access controls rolled everything into a single ACI. I broke it out into separate ACIs for add, delete and add. I also added a new dns type for the permission plugin. ticket 628
2010-12-17 14:04:47 -06:00
changetype: add
objectClass: groupofnames
objectClass: top
cn: update dns entries
description: Update DNS entries
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
member: cn=DNS Administrators,cn=privileges,cn=pbac,$SUFFIX
member: cn=DNS Servers,cn=privileges,cn=pbac,$SUFFIX
Fix the change_password permissions and the DNS access controls. The change_password permission was too broad, limit it to users. The DNS access controls rolled everything into a single ACI. I broke it out into separate ACIs for add, delete and add. I also added a new dns type for the permission plugin. ticket 628
2010-12-17 14:04:47 -06:00
dn: $SUFFIX
changetype: modify
add: aci
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
aci: (target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "Add DNS entries";allow (add) groupdn = "ldap:///cn=add dns entries,cn=permissions,cn=pbac,$SUFFIX";)
aci: (target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "Remove DNS entries";allow (delete) groupdn = "ldap:///cn=remove dns entries,cn=permissions,cn=pbac,$SUFFIX";)
aci: (targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy")(target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "Update DNS entries";allow (write) groupdn = "ldap:///cn=update dns entries,cn=permissions,cn=pbac,$SUFFIX";)
Fix the change_password permissions and the DNS access controls. The change_password permission was too broad, limit it to users. The DNS access controls rolled everything into a single ACI. I broke it out into separate ACIs for add, delete and add. I also added a new dns type for the permission plugin. ticket 628
2010-12-17 14:04:47 -06:00
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=DNS Administrators,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
objectClass: nestedgroup
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: DNS Administrators
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
description: DNS Administrators
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=DNS Servers,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
objectClass: nestedgroup
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: DNS Servers
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
description: DNS Servers
Reference in New Issue Copy Permalink