IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-30 10:47:08 -06:00
Code Issues Packages Projects Releases Wiki Activity
fb975bba20
freeipa/install/share/delegation.ldif

269 lines
8.3 KiB
Plaintext
Raw Normal View History

Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
############################################
# Configure the DIT
############################################
dn: cn=roles,cn=accounts,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: nsContainer
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
cn: roles
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
# Permissions-based Access Control
dn: cn=pbac,$SUFFIX
changetype: add
objectClass: top
objectClass: nsContainer
cn: pbac
dn: cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: nsContainer
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
cn: privileges
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Move permissions and privileges to their own container, cn=pbac,$SUFFIX ticket 638
2010-12-22 10:11:29 -06:00
dn: cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: nsContainer
cn: permissions
############################################
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
# Add the default roles
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
############################################
dn: cn=helpdesk,cn=roles,cn=accounts,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
cn: helpdesk
description: Helpdesk
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
############################################
# Add the default privileges
############################################
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=User Administrators,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: User Administrators
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
description: User Administrators
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Group Administrators,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Group Administrators
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
description: Group Administrators
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Host Administrators
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
description: Host Administrators
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Host Group Administrators,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Host Group Administrators
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
description: Host Group Administrators
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Delegation Administrator,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Delegation Administrator
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
description: Role administration
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Service Administrators,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Service Administrators
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
description: Service Administrators
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Automount Administrators,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Automount Administrators
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
description: Automount Administrators
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Netgroups Administrators,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Netgroups Administrators
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
description: Netgroups Administrators
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Certificate Administrators,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
objectClass: nestedgroup
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Certificate Administrators
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
description: Certificate Administrators
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Replication Administrators,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
objectClass: nestedgroup
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Replication Administrators
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
description: Replication Administrators
member: cn=admins,cn=groups,cn=accounts,$SUFFIX
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Host Enrollment,cn=privileges,cn=pbac,$SUFFIX
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
changetype: add
objectClass: top
objectClass: groupofnames
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
objectClass: nestedgroup
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Host Enrollment
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
description: Host Enrollment
Basic changes to get a default principal for DNS Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-06-04 14:33:49 -05:00
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
############################################
# Default permissions.
############################################
# DNS administration
# The permission and aci for this is in install/updates/dns.ldif
# Replica administration
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Add Replication Agreements,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
Add new schema to store information about permissions. There are some permissions we can't display because they are stored outside of the basedn (such as the replication permissions). We are adding a new attribute to store extra information to make this clear, in this case SYSTEM. ticket 853
2011-02-01 10:57:18 -06:00
objectClass: ipapermission
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Add Replication Agreements
Add new schema to store information about permissions. There are some permissions we can't display because they are stored outside of the basedn (such as the replication permissions). We are adding a new attribute to store extra information to make this clear, in this case SYSTEM. ticket 853
2011-02-01 10:57:18 -06:00
ipapermissiontype: SYSTEM
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
member: cn=Replication Administrators,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Modify Replication Agreements,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
Add new schema to store information about permissions. There are some permissions we can't display because they are stored outside of the basedn (such as the replication permissions). We are adding a new attribute to store extra information to make this clear, in this case SYSTEM. ticket 853
2011-02-01 10:57:18 -06:00
objectClass: ipapermission
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Modify Replication Agreements
Add new schema to store information about permissions. There are some permissions we can't display because they are stored outside of the basedn (such as the replication permissions). We are adding a new attribute to store extra information to make this clear, in this case SYSTEM. ticket 853
2011-02-01 10:57:18 -06:00
ipapermissiontype: SYSTEM
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
member: cn=Replication Administrators,cn=privileges,cn=pbac,$SUFFIX
Remove referrals when removing agreements Part of this fix requires also giving proper permission to change the replication agreements root. While there also fix replica-related permissions to have the classic add/modify/remove triplet of permissions. Fixes: https://fedorahosted.org/freeipa/ticket/630
2010-12-20 09:05:17 -06:00
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Remove Replication Agreements,cn=permissions,cn=pbac,$SUFFIX
Remove referrals when removing agreements Part of this fix requires also giving proper permission to change the replication agreements root. While there also fix replica-related permissions to have the classic add/modify/remove triplet of permissions. Fixes: https://fedorahosted.org/freeipa/ticket/630
2010-12-20 09:05:17 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
Add new schema to store information about permissions. There are some permissions we can't display because they are stored outside of the basedn (such as the replication permissions). We are adding a new attribute to store extra information to make this clear, in this case SYSTEM. ticket 853
2011-02-01 10:57:18 -06:00
objectClass: ipapermission
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Remove Replication Agreements
Add new schema to store information about permissions. There are some permissions we can't display because they are stored outside of the basedn (such as the replication permissions). We are adding a new attribute to store extra information to make this clear, in this case SYSTEM. ticket 853
2011-02-01 10:57:18 -06:00
ipapermissiontype: SYSTEM
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
member: cn=Replication Administrators,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
Extend ipa-replica-manage to be able to manage DNA ranges. Attempt to automatically save DNA ranges when a master is removed. This is done by trying to find a master that does not yet define a DNA on-deck range. If one can be found then the range on the deleted master is added. If one cannot be found then it is reported as an error. Some validation of the ranges are done to ensure that they do overlap an IPA local range and do not overlap existing DNA ranges configured on other masters. http://freeipa.org/page/V3/Recover_DNA_Ranges https://fedorahosted.org/freeipa/ticket/3321
2013-03-01 14:02:14 -06:00
dn: cn=Modify DNA Range,cn=permissions,cn=pbac,$SUFFIX
changetype: add
objectClass: top
objectClass: groupofnames
objectClass: ipapermission
cn: Modify DNA Range
ipapermissiontype: SYSTEM
member: cn=Replication Administrators,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Create virtual operations entry. This is used to control access to
# operations that don't rely on LDAP directly.
Move Virtual Operations container under cn=etc Fixes: https://fedorahosted.org/freeipa/ticket/759
2011-01-13 14:54:06 -06:00
dn: cn=virtual operations,cn=etc,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: nsContainer
cn: virtual operations
# Retrieve Certificate virtual op
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
Add new schema to store information about permissions. There are some permissions we can't display because they are stored outside of the basedn (such as the replication permissions). We are adding a new attribute to store extra information to make this clear, in this case SYSTEM. ticket 853
2011-02-01 10:57:18 -06:00
objectClass: ipapermission
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Retrieve Certificates from the CA
member: cn=Certificate Administrators,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
dn: $SUFFIX
changetype: modify
add: aci
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
aci: (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Request Certificate virtual op
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Request Certificate,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
Add new schema to store information about permissions. There are some permissions we can't display because they are stored outside of the basedn (such as the replication permissions). We are adding a new attribute to store extra information to make this clear, in this case SYSTEM. ticket 853
2011-02-01 10:57:18 -06:00
objectClass: ipapermission
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Request Certificate
member: cn=Certificate Administrators,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
dn: $SUFFIX
changetype: modify
add: aci
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
aci: (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Request Certificate from different host virtual op
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Request Certificates from a different host,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
Add new schema to store information about permissions. There are some permissions we can't display because they are stored outside of the basedn (such as the replication permissions). We are adding a new attribute to store extra information to make this clear, in this case SYSTEM. ticket 853
2011-02-01 10:57:18 -06:00
objectClass: ipapermission
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Request Certificates from a different host
member: cn=Certificate Administrators,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
dn: $SUFFIX
changetype: modify
add: aci
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
aci: (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Certificate Status virtual op
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Get Certificates status from the CA,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
Add new schema to store information about permissions. There are some permissions we can't display because they are stored outside of the basedn (such as the replication permissions). We are adding a new attribute to store extra information to make this clear, in this case SYSTEM. ticket 853
2011-02-01 10:57:18 -06:00
objectClass: ipapermission
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Get Certificates status from the CA
member: cn=Certificate Administrators,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
dn: $SUFFIX
changetype: modify
add: aci
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
aci: (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Revoke Certificate virtual op
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Revoke Certificate,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
Add new schema to store information about permissions. There are some permissions we can't display because they are stored outside of the basedn (such as the replication permissions). We are adding a new attribute to store extra information to make this clear, in this case SYSTEM. ticket 853
2011-02-01 10:57:18 -06:00
objectClass: ipapermission
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Revoke Certificate
member: cn=Certificate Administrators,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
dn: $SUFFIX
changetype: modify
add: aci
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
aci: (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,$SUFFIX";)
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
# Certificate Remove Hold virtual op
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
dn: cn=Certificate Remove Hold,cn=permissions,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
changetype: add
objectClass: top
objectClass: groupofnames
Add new schema to store information about permissions. There are some permissions we can't display because they are stored outside of the basedn (such as the replication permissions). We are adding a new attribute to store extra information to make this clear, in this case SYSTEM. ticket 853
2011-02-01 10:57:18 -06:00
objectClass: ipapermission
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
cn: Certificate Remove Hold
member: cn=Certificate Administrators,cn=privileges,cn=pbac,$SUFFIX
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
dn: $SUFFIX
changetype: modify
add: aci
Rename permissions and privileges to be more readable. This also drops description from permissions since it seems redundant and fixes up the help text a little. ticket 792
2011-01-31 10:01:56 -06:00
aci: (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,$SUFFIX";)
Reference in New Issue Copy Permalink