IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-27 09:21:59 -06:00
Code Issues Packages Projects Releases Wiki Activity
c594ab88ba
freeipa/install/share/bootstrap-template.ldif

274 lines
6.1 KiB
Plaintext
Raw Normal View History

Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=accounts,$SUFFIX
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested!
2007-06-28 18:09:54 -05:00
changetype: add
import initial install tool
0000-12-31 18:09:24 -05:50
objectClass: top
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
objectClass: nsContainer
Fix installation Add missing schema for GUI Config, and missing objectclass for cn=accounts container
2007-11-18 14:02:26 -06:00
objectClass: krbPwdPolicy
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
cn: accounts
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 11:59:32 -06:00
krbMinPwdLife: 3600
krbPwdMinDiffChars: 0
krbPwdMinLength: 8
krbPwdHistoryLength: 0
Increase default max password lifetime from 10 to 90 days
2007-12-03 17:09:14 -06:00
krbMaxPwdLife: 7776000
import initial install tool
0000-12-31 18:09:24 -05:50
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=users,cn=accounts,$SUFFIX
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested!
2007-06-28 18:09:54 -05:00
changetype: add
import initial install tool
0000-12-31 18:09:24 -05:50
objectClass: top
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
objectClass: nsContainer
cn: users
import initial install tool
0000-12-31 18:09:24 -05:50
More DIT fixes discovered after testing
2007-08-31 17:36:54 -05:00
dn: cn=groups,cn=accounts,$SUFFIX
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested!
2007-06-28 18:09:54 -05:00
changetype: add
import initial install tool
0000-12-31 18:09:24 -05:50
objectClass: top
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
objectClass: nsContainer
cn: groups
import initial install tool
0000-12-31 18:09:24 -05:50
Add xml-rpc interface for getting keytabs. Warning: this lacks any sort of authorization.
0000-12-31 18:09:24 -05:50
dn: cn=services,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: services
import initial install tool
0000-12-31 18:09:24 -05:50
minor typos
2007-11-30 15:58:02 -06:00
dn: cn=computers,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: computers
Add groups of services to HBAC Replace serviceName with memberService so we can assign individual services or groups of services to an HBAC rule. 588574
2010-05-14 08:37:54 -05:00
dn: cn=hbacservices,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: hbacservices
dn: cn=hbacservicegroups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: hbacservicegroups
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
dn: cn=sudocmds,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: sudocmds
dn: cn=sudocmdgroups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: sudocmdgroups
Add HBAC plugin and introduce GeneralizedTime parameter type.
2009-09-30 09:24:25 -05:00
dn: cn=hbac,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: hbac
Add plugins for Sudo Commands, Command Groups and Rules
2010-09-27 15:51:28 -05:00
dn: cn=sudorules,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: sudorules
Enabling SUDO support * Adding a new SUDO schema file * Adding this new file to the list of targets in make file * Create SUDO container for sudo rules * Add default sudo services to HBAC services * Add default SUDO HBAC service group with two services sudo & sudo-i * Installing schema No SUDO rules are created by default by this patch.
2010-09-08 21:44:42 -05:00
dn: cn=SUDOers,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: SUDOers
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=etc,$SUFFIX
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
changetype: add
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
objectClass: nsContainer
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
objectClass: top
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
cn: etc
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=sysaccounts,cn=etc,$SUFFIX
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
changetype: add
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
objectClass: nsContainer
objectClass: top
cn: sysaccounts
Add container and initial ACIs for entitlement support The entitlement entries themselves will be rather simple, consisting of the objectClasses ipaObject and pkiUser. We will just store userCertificate in it. The DN will contain the UUID of the entitlement. ticket #27
2010-07-21 14:44:49 -05:00
dn: cn=entitlements,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: entitlements
Add posix auto gen for single master case
2007-11-06 17:57:15 -06:00
dn: cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: ipa
dn: cn=masters,cn=ipa,cn=etc,$SUFFIX
changetype: add
objectClass: nsContainer
objectClass: top
cn: masters
Move admin into cn=users,cn=accounts After some deep thinking I think the advantages of keeping all posix enabled user accounts under cn=users,cn=accounts overweight a perceived better protection of the admin account by keeping it in a separate tree.
2008-05-22 16:55:27 -05:00
dn: uid=admin,cn=users,cn=accounts,$SUFFIX
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
changetype: add
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
objectClass: top
objectClass: person
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
objectClass: posixaccount
objectClass: krbprincipalaux
Add default values for krb ticket policy attributes during installation.
2010-01-12 09:30:00 -06:00
objectClass: krbticketpolicyaux
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
objectClass: inetuser
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
uid: admin
krbPrincipalName: admin@$REALM
cn: Administrator
sn: Administrator
Add option to the installer for uid/gid starting numbers. This also adds a new option to the template system. If you include eval(string) in a file that goes through the templater then the string in the eval will be evaluated by the Python interpreter. This is used so one can do $UIDSTART+1. If any errors occur during the evaluation the original string is is returned, eval() and all so it is up to the developer to make sure the evaluation passes. The default value for uid and gid is now a random value between 1,000,000 and (2^31 - 1,000,000)
2009-08-27 13:12:55 -05:00
uidNumber: $UIDSTART
gidNumber: $GIDSTART
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
homeDirectory: /home/admin
loginShell: /bin/bash
gecos: Administrator
- Better access control, make sure not even admins can read out passwords - Insure admins can't locked out by mistake by inclusion in disabled groups - Fix also minor error in krbinstance.py
2007-12-11 20:56:36 -06:00
nsAccountLock: False
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
change location of radius data in ldap from cn=radius,cn=services,cn=etc to cn=radius
2007-11-30 19:29:12 -06:00
dn: cn=radius,$SUFFIX
radius now does kerberos auth, reads client entries from LDAP
2007-11-09 23:09:07 -06:00
changetype: add
objectClass: nsContainer
objectClass: top
cn: radius
change location of radius data in ldap from cn=radius,cn=services,cn=etc to cn=radius
2007-11-30 19:29:12 -06:00
dn: cn=clients,cn=radius,$SUFFIX
radius now does kerberos auth, reads client entries from LDAP
2007-11-09 23:09:07 -06:00
changetype: add
objectClass: nsContainer
objectClass: top
cn: clients
change location of radius data in ldap from cn=radius,cn=services,cn=etc to cn=radius
2007-11-30 19:29:12 -06:00
dn: cn=profiles,cn=radius,$SUFFIX
checkpoint radius client work
2007-11-13 12:06:18 -06:00
changetype: add
objectClass: nsContainer
objectClass: top
cn: profiles
change location of radius data in ldap from cn=radius,cn=services,cn=etc to cn=radius
2007-11-30 19:29:12 -06:00
dn: uid=ipa_default, cn=profiles,cn=radius,$SUFFIX
checkpoint radius client work
2007-11-13 12:06:18 -06:00
changetype: add
objectClass: top
objectClass: radiusprofile
Add radius profile implementations: get_radius_profile_by_uid add_radius_profile update_radius_profile delete_radius_profile find_radius_profiles Rewrite command line arg handling, now support pair entry, interactive mode with auto completion, reading pairs from a file, better handling of mandatory values, better help, long arg names now match attribute name in pairs Establish mappings for all attributes and names used in clients and profiles Add notion of containers to radius clients and profiles in LDAP Move common code, variables, constants, and strings into the files radius_client.py, radius_util.py, ipautil.py to eliminate redundant elements which could get out of sync if modified and to provide access to other code which might benefit from using these items in the future. Add utility functions: format_list() parse_key_value_pairs() Add utility class: AttributeValueCompleter Unify attribute usage in radius ldap schema
2007-11-21 12:11:10 -06:00
uid: ipa_default
checkpoint radius client work
2007-11-13 12:06:18 -06:00
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=admins,cn=groups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
Use groupOfNames and member, not groupOfUniqueNames and uniqueMember
2007-11-20 09:22:43 -06:00
objectClass: groupofnames
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
objectClass: posixgroup
Add ipaUserGroup objectClass to default groups where missing.
2009-12-01 06:41:47 -06:00
objectClass: ipausergroup
patch queue: admin_account_fix.patch
2007-10-04 15:41:19 -05:00
cn: admins
Integrate corrections pointed out on the list
2007-08-30 11:23:39 -05:00
description: Account administrators group
Add option to the installer for uid/gid starting numbers. This also adds a new option to the template system. If you include eval(string) in a file that goes through the templater then the string in the eval will be evaluated by the Python interpreter. This is used so one can do $UIDSTART+1. If any errors occur during the evaluation the original string is is returned, eval() and all so it is up to the developer to make sure the evaluation passes. The default value for uid and gid is now a random value between 1,000,000 and (2^31 - 1,000,000)
2009-08-27 13:12:55 -05:00
gidNumber: $GIDSTART
Move admin into cn=users,cn=accounts After some deep thinking I think the advantages of keeping all posix enabled user accounts under cn=users,cn=accounts overweight a perceived better protection of the admin account by keeping it in a separate tree.
2008-05-22 16:55:27 -05:00
member: uid=admin,cn=users,cn=accounts,$SUFFIX
- Better access control, make sure not even admins can read out passwords - Insure admins can't locked out by mistake by inclusion in disabled groups - Fix also minor error in krbinstance.py
2007-12-11 20:56:36 -06:00
nsAccountLock: False
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
dn: cn=ipausers,cn=groups,cn=accounts,$SUFFIX
- Abstracted client class to work directly or over RPC - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
2007-08-06 09:05:53 -05:00
changetype: add
objectClass: top
Use groupOfNames and member, not groupOfUniqueNames and uniqueMember
2007-11-20 09:22:43 -06:00
objectClass: groupofnames
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
objectClass: nestedgroup
objectClass: ipausergroup
objectClass: posixgroup
Add option to the installer for uid/gid starting numbers. This also adds a new option to the template system. If you include eval(string) in a file that goes through the templater then the string in the eval will be evaluated by the Python interpreter. This is used so one can do $UIDSTART+1. If any errors occur during the evaluation the original string is is returned, eval() and all so it is up to the developer to make sure the evaluation passes. The default value for uid and gid is now a random value between 1,000,000 and (2^31 - 1,000,000)
2009-08-27 13:12:55 -05:00
gidNumber: eval($GIDSTART+1)
Add an editors group. This is used to generally grant access for users to edit other users (the Edit link won't appear otherwise). Additional delegation is need to grant permission to individual attributes. Update the failed login page to indicate that it is a permission issue. Don't allow access to policy at all for non-admins. By default users can only edit themselves.
2007-11-14 09:49:03 -06:00
description: Default group for all users
Finalize DIT, this is waht we are probably going to have in the end, or something very close to this one Add default groups and admin user TODO: need to discuss more in deep uid/gid generation, this will probably change as soon as the DNA plugin is activated
2007-08-29 17:07:05 -05:00
cn: ipausers
Add an editors group. This is used to generally grant access for users to edit other users (the Edit link won't appear otherwise). Additional delegation is need to grant permission to individual attributes. Update the failed login page to indicate that it is a permission issue. Don't allow access to policy at all for non-admins. By default users can only edit themselves.
2007-11-14 09:49:03 -06:00
dn: cn=editors,cn=groups,cn=accounts,$SUFFIX
changetype: add
objectClass: top
Use groupOfNames and member, not groupOfUniqueNames and uniqueMember
2007-11-20 09:22:43 -06:00
objectClass: groupofnames
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
objectClass: posixgroup
Add ipaUserGroup objectClass to default groups where missing.
2009-12-01 06:41:47 -06:00
objectClass: ipausergroup
Add option to the installer for uid/gid starting numbers. This also adds a new option to the template system. If you include eval(string) in a file that goes through the templater then the string in the eval will be evaluated by the Python interpreter. This is used so one can do $UIDSTART+1. If any errors occur during the evaluation the original string is is returned, eval() and all so it is up to the developer to make sure the evaluation passes. The default value for uid and gid is now a random value between 1,000,000 and (2^31 - 1,000,000)
2009-08-27 13:12:55 -05:00
gidNumber: eval($GIDSTART+2)
Add an editors group. This is used to generally grant access for users to edit other users (the Edit link won't appear otherwise). Additional delegation is need to grant permission to individual attributes. Update the failed login page to indicate that it is a permission issue. Don't allow access to policy at all for non-admins. By default users can only edit themselves.
2007-11-14 09:49:03 -06:00
description: Limited admins who can edit other users
cn: editors
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 11:59:32 -06:00
Minor fixes.
0000-12-31 18:09:24 -05:50
dn: cn=ipaConfig,cn=etc,$SUFFIX
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 11:59:32 -06:00
changetype: add
objectClass: nsContainer
objectClass: top
objectClass: ipaGuiConfig
Add options to control NTLM hashes By default LM hash is disabled. Of course generation still depends on whether the SamAccount objectclass is present in the user object.
2010-10-04 14:13:36 -05:00
objectClass: ipaConfigObject
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
ipaUserSearchFields: uid,givenname,sn,telephonenumber,ou,title
Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization.
2007-11-16 11:59:32 -06:00
ipaGroupSearchFields: cn,description
ipaSearchTimeLimit: 2
ipaSearchRecordsLimit: 0
ipaHomesRootDir: /home
ipaDefaultLoginShell: /bin/sh
ipaDefaultPrimaryGroup: ipausers
ipaMaxUsernameLength: 8
ipaPwdExpAdvNotify: 4
Utilize user and group objectclass lists in cn=ipaconfig Change the syntax on user and group objectclasses in cn=ipaconfig
2007-12-05 23:30:26 -06:00
ipaGroupObjectClasses: top
ipaGroupObjectClasses: groupofnames
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
ipaGroupObjectClasses: nestedgroup
ipaGroupObjectClasses: ipausergroup
Add a new objectclass, ipaObject, that will add a UUID to many IPA objects ipaObject is defined as an auxiliary objectclass so it is up to the plugin author to ensure that the objectclass is included an a UUID generated. ipaUniqueId is a MUST attribute so if you include the objectclass you must ensure that the uuid is generated. This also fixes up some unrelated unit test failures.
2009-08-10 15:24:10 -05:00
ipaGroupObjectClasses: ipaobject
Utilize user and group objectclass lists in cn=ipaconfig Change the syntax on user and group objectclasses in cn=ipaconfig
2007-12-05 23:30:26 -06:00
ipaUserObjectClasses: top
ipaUserObjectClasses: person
Make object classes of automatically created entries lowercase. This makes them more consistent with entries created by plugins. It's a cosmetic thing, not that useful.
2009-07-10 05:17:42 -05:00
ipaUserObjectClasses: organizationalperson
ipaUserObjectClasses: inetorgperson
ipaUserObjectClasses: inetuser
ipaUserObjectClasses: posixaccount
ipaUserObjectClasses: krbprincipalaux
Add default values for krb ticket policy attributes during installation.
2010-01-12 09:30:00 -06:00
ipaUserObjectClasses: krbticketpolicyaux
Utilize user and group objectclass lists in cn=ipaconfig Change the syntax on user and group objectclasses in cn=ipaconfig
2007-12-05 23:30:26 -06:00
ipaUserObjectClasses: radiusprofile
Add a new objectclass, ipaObject, that will add a UUID to many IPA objects ipaObject is defined as an auxiliary objectclass so it is up to the plugin author to ensure that the objectclass is included an a UUID generated. ipaUniqueId is a MUST attribute so if you include the objectclass you must ensure that the uuid is generated. This also fixes up some unrelated unit test failures.
2009-08-10 15:24:10 -05:00
ipaUserObjectClasses: ipaobject
Add default e-mail domain to the IPA configuration
2007-12-10 10:53:00 -06:00
ipaDefaultEmailDomain: $DOMAIN
Add BIND pre-op for DS->IPA password migration to ipa-pwd-extop DS plugin.
2009-09-04 07:51:28 -05:00
ipaMigrationEnabled: FALSE
Add options to control NTLM hashes By default LM hash is disabled. Of course generation still depends on whether the SamAccount objectclass is present in the user object.
2010-10-04 14:13:36 -05:00
ipaConfigString: AllowNThash
Enable group inactivation by using the Class of Service plugin. This adds 2 new groups: activated and inactivated. If you, or a group you are a member of, is in inactivated then you are too. If you, or a group you are a member of, is in the activated group, then you are too. In a fight between activated and inactivated, activated wins. The DNs for doing this matching is case and white space sensitive. The goal is to never have to actually set nsAccountLock in a user directly but move them between these groups. We need to decide where in the CLI this will happen. Right it is split between ipa-deluser and ipa-usermod. To inactivate groups for now just add the group to inactivate or active.
2007-11-20 21:45:29 -06:00
dn: cn=account inactivation,cn=accounts,$SUFFIX
Add utility to lock user accounts. Remove lock capability from ipa-deluser Fix bootstrap.ldif to add new Class of Service entries properly Include some man pages that weren't being installed
2007-11-26 21:28:53 -06:00
changetype: add
Enable group inactivation by using the Class of Service plugin. This adds 2 new groups: activated and inactivated. If you, or a group you are a member of, is in inactivated then you are too. If you, or a group you are a member of, is in the activated group, then you are too. In a fight between activated and inactivated, activated wins. The DNs for doing this matching is case and white space sensitive. The goal is to never have to actually set nsAccountLock in a user directly but move them between these groups. We need to decide where in the CLI this will happen. Right it is split between ipa-deluser and ipa-usermod. To inactivate groups for now just add the group to inactivate or active.
2007-11-20 21:45:29 -06:00
description: Lock accounts based on group membership
objectClass: top
objectClass: ldapsubentry
objectClass: cosSuperDefinition
objectClass: cosClassicDefinition
cosTemplateDn: cn=cosTemplates,cn=accounts,$SUFFIX
cosAttribute: nsAccountLock operational
cosSpecifier: memberOf
cn: Account Inactivation
dn: cn=cosTemplates,cn=accounts,$SUFFIX
Add utility to lock user accounts. Remove lock capability from ipa-deluser Fix bootstrap.ldif to add new Class of Service entries properly Include some man pages that weren't being installed
2007-11-26 21:28:53 -06:00
changetype: add
Enable group inactivation by using the Class of Service plugin. This adds 2 new groups: activated and inactivated. If you, or a group you are a member of, is in inactivated then you are too. If you, or a group you are a member of, is in the activated group, then you are too. In a fight between activated and inactivated, activated wins. The DNs for doing this matching is case and white space sensitive. The goal is to never have to actually set nsAccountLock in a user directly but move them between these groups. We need to decide where in the CLI this will happen. Right it is split between ipa-deluser and ipa-usermod. To inactivate groups for now just add the group to inactivate or active.
2007-11-20 21:45:29 -06:00
objectclass: top
objectclass: nsContainer
cn: cosTemplates
Use escapes in DNs instead of quoting. Based on initial patch from Pavel Zuna.
2010-04-16 15:23:45 -05:00
dn: cn=cn\=inactivated\,cn\=account inactivation\,cn\=accounts\,$ESCAPED_SUFFIX,cn=cosTemplates,cn=accounts,$SUFFIX
Add utility to lock user accounts. Remove lock capability from ipa-deluser Fix bootstrap.ldif to add new Class of Service entries properly Include some man pages that weren't being installed
2007-11-26 21:28:53 -06:00
changetype: add
Enable group inactivation by using the Class of Service plugin. This adds 2 new groups: activated and inactivated. If you, or a group you are a member of, is in inactivated then you are too. If you, or a group you are a member of, is in the activated group, then you are too. In a fight between activated and inactivated, activated wins. The DNs for doing this matching is case and white space sensitive. The goal is to never have to actually set nsAccountLock in a user directly but move them between these groups. We need to decide where in the CLI this will happen. Right it is split between ipa-deluser and ipa-usermod. To inactivate groups for now just add the group to inactivate or active.
2007-11-20 21:45:29 -06:00
objectClass: top
objectClass: cosTemplate
objectClass: extensibleobject
nsAccountLock: true
cosPriority: 1
dn: cn=inactivated,cn=account inactivation,cn=accounts,$SUFFIX
Add utility to lock user accounts. Remove lock capability from ipa-deluser Fix bootstrap.ldif to add new Class of Service entries properly Include some man pages that weren't being installed
2007-11-26 21:28:53 -06:00
changetype: add
Enable group inactivation by using the Class of Service plugin. This adds 2 new groups: activated and inactivated. If you, or a group you are a member of, is in inactivated then you are too. If you, or a group you are a member of, is in the activated group, then you are too. In a fight between activated and inactivated, activated wins. The DNs for doing this matching is case and white space sensitive. The goal is to never have to actually set nsAccountLock in a user directly but move them between these groups. We need to decide where in the CLI this will happen. Right it is split between ipa-deluser and ipa-usermod. To inactivate groups for now just add the group to inactivate or active.
2007-11-20 21:45:29 -06:00
objectclass: top
more s/unique// wrt groups members/objectclasses
2007-11-21 15:07:07 -06:00
objectclass: groupofnames
Enable group inactivation by using the Class of Service plugin. This adds 2 new groups: activated and inactivated. If you, or a group you are a member of, is in inactivated then you are too. If you, or a group you are a member of, is in the activated group, then you are too. In a fight between activated and inactivated, activated wins. The DNs for doing this matching is case and white space sensitive. The goal is to never have to actually set nsAccountLock in a user directly but move them between these groups. We need to decide where in the CLI this will happen. Right it is split between ipa-deluser and ipa-usermod. To inactivate groups for now just add the group to inactivate or active.
2007-11-20 21:45:29 -06:00
Use escapes in DNs instead of quoting. Based on initial patch from Pavel Zuna.
2010-04-16 15:23:45 -05:00
dn: cn=cn\=activated\,cn\=account inactivation\,cn\=accounts\,$ESCAPED_SUFFIX,cn=cosTemplates,cn=accounts,$SUFFIX
Add utility to lock user accounts. Remove lock capability from ipa-deluser Fix bootstrap.ldif to add new Class of Service entries properly Include some man pages that weren't being installed
2007-11-26 21:28:53 -06:00
changetype: add
Enable group inactivation by using the Class of Service plugin. This adds 2 new groups: activated and inactivated. If you, or a group you are a member of, is in inactivated then you are too. If you, or a group you are a member of, is in the activated group, then you are too. In a fight between activated and inactivated, activated wins. The DNs for doing this matching is case and white space sensitive. The goal is to never have to actually set nsAccountLock in a user directly but move them between these groups. We need to decide where in the CLI this will happen. Right it is split between ipa-deluser and ipa-usermod. To inactivate groups for now just add the group to inactivate or active.
2007-11-20 21:45:29 -06:00
objectClass: top
objectClass: cosTemplate
objectClass: extensibleobject
nsAccountLock: false
cosPriority: 0
dn: cn=Activated,cn=Account Inactivation,cn=accounts,$SUFFIX
Add utility to lock user accounts. Remove lock capability from ipa-deluser Fix bootstrap.ldif to add new Class of Service entries properly Include some man pages that weren't being installed
2007-11-26 21:28:53 -06:00
changetype: add
Enable group inactivation by using the Class of Service plugin. This adds 2 new groups: activated and inactivated. If you, or a group you are a member of, is in inactivated then you are too. If you, or a group you are a member of, is in the activated group, then you are too. In a fight between activated and inactivated, activated wins. The DNs for doing this matching is case and white space sensitive. The goal is to never have to actually set nsAccountLock in a user directly but move them between these groups. We need to decide where in the CLI this will happen. Right it is split between ipa-deluser and ipa-usermod. To inactivate groups for now just add the group to inactivate or active.
2007-11-20 21:45:29 -06:00
objectclass: top
more s/unique// wrt groups members/objectclasses
2007-11-21 15:07:07 -06:00
objectclass: groupofnames
Add support for per-group kerberos password policy. Use a Class of Service template to do per-group password policy. The design calls for non-overlapping groups but with cospriority we can still make sense of things. The password policy entries stored under the REALM are keyed only on the group name because the MIT ldap plugin can't handle quotes in the DN. It also can't handle spaces between elements in the DN.
2009-10-02 08:30:16 -05:00
# templates for this cos definition are managed by the pwpolicy plugin
dn: cn=Password Policy,cn=accounts,$SUFFIX
changetype: add
description: Password Policy based on group membership
objectClass: top
objectClass: ldapsubentry
objectClass: cosSuperDefinition
objectClass: cosClassicDefinition
cosTemplateDn: cn=cosTemplates,cn=accounts,$SUFFIX
cosAttribute: krbPwdPolicyReference
cosSpecifier: memberOf
Reference in New Issue Copy Permalink