IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Allow IPA master hosts to read and update IPA master information.

Browse Source 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This commit is contained in:
Jan Cholasta 2014-06-12 08:37:40 +02:00 committed by Petr Viktorin
parent 61159b7ff2
commit 1778f0ebc9
2 changed files with 42 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
install/updates/40-delegation.update
View File

@ -177,3 +177,7 @@ default:objectClass: groupofnames
default:objectClass: top
default:cn: IPA Masters Readers
default:description: Read list of IPA masters
dn: cn=masters,cn=ipa,cn=etc,$SUFFIX
add:aci:'(targetfilter = "(objectClass=nsContainer)")(targetattr = "cn || objectClass || ipaConfigString")(version 3.0; acl "Read IPA Masters"; allow (read, search, compare) userdn = "ldap:///fqdn=$FQDN,cn=computers,cn=accounts,$SUFFIX";)'
add:aci:'(targetfilter = "(objectClass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Modify IPA Masters"; allow (write) userdn = "ldap:///fqdn=$FQDN,cn=computers,cn=accounts,$SUFFIX";)'

38
ipaserver/install/replication.py
View File

@ -1244,6 +1244,44 @@ class ReplicationManager(object):
elif not err:
err = e
try:
entry = self.conn.get_entry(
DN(('cn', 'masters'), ('cn', 'ipa'), ('cn', 'etc'),
self.suffix),
['aci'])
sub = {'suffix': self.suffix, 'fqdn': replica}
try:
entry.raw['aci'].remove(
'(targetfilter = "(objectClass=nsContainer)")'
'(targetattr = "cn || objectClass || ipaConfigString")'
'(version 3.0; acl "Read IPA Masters"; allow (read, '
'search, compare) userdn = "ldap:///fqdn=%(fqdn)s,'
'cn=computers,cn=accounts,%(suffix)s";)' % sub)
except ValueError:
pass
try:
entry.raw['aci'].remove(
'(targetfilter = "(objectClass=nsContainer)")'
'(targetattr = "ipaConfigString")(version 3.0; acl '
'"Modify IPA Masters"; allow (write) userdn = '
'"ldap:///fqdn=%(fqdn)s,cn=computers,cn=accounts,'
'%(suffix)s";)' % sub)
except ValueError:
pass
try:
self.conn.update_entry(entry)
except errors.EmptyModlist:
pass
except errors.NotFound:
pass
except Exception, e:
if not force:
raise e
elif not err:
err = e
try:
basedn = DN(('cn', 'etc'), self.suffix)
filter = '(dnaHostname=%s)' % replica