IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Fix quoting to work with new csv handler in ldapupdate

Browse Source
This commit is contained in:
Rob Crittenden
2009-05-13 17:10:03 -04:00
committed by Jason Gerard DeRose
parent 9437fc669e
commit 86472a94ee
2 changed files with 113 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
install/updates/10-RFC4876.update
View File

@@ -52,7 +52,7 @@ add:attributeTypes:
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE SINGLE-VALUE
X-ORIGIN 'RFC4876' ) X-ORIGIN 'RFC4876' )
add:attributeTypes: add:attributeTypes:"
( 1.3.6.1.4.1.11.1.3.1.1.6 NAME 'authenticationMethod' ( 1.3.6.1.4.1.11.1.3.1.1.6 NAME 'authenticationMethod'
DESC 'Identifies the types of authentication methods either DESC 'Identifies the types of authentication methods either
used, required, or provided by a service or peer' used, required, or provided by a service or peer'
@@ -60,8 +60,8 @@ add:attributeTypes:
SUBSTR caseIgnoreSubstringsMatch SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE SINGLE-VALUE
X-ORIGIN 'RFC4876' ) X-ORIGIN 'RFC4876' )"
add:attributeTypes: add:attributeTypes:"
( 1.3.6.1.4.1.11.1.3.1.1.7 NAME 'profileTTL' ( 1.3.6.1.4.1.11.1.3.1.1.7 NAME 'profileTTL'
DESC 'Time to live, in seconds, before a profile is DESC 'Time to live, in seconds, before a profile is
considered stale' considered stale'
@@ -69,29 +69,29 @@ add:attributeTypes:
ORDERING integerOrderingMatch ORDERING integerOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE SINGLE-VALUE
X-ORIGIN 'RFC4876' ) X-ORIGIN 'RFC4876' )"
add:attributeTypes: add:attributeTypes:"
( 1.3.6.1.4.1.11.1.3.1.1.9 NAME 'attributeMap' ( 1.3.6.1.4.1.11.1.3.1.1.9 NAME 'attributeMap'
DESC 'Attribute mappings used, required, or supported by an DESC 'Attribute mappings used, required, or supported by an
agent or service' agent or service'
EQUALITY caseIgnoreIA5Match EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
X-ORIGIN 'RFC4876' ) X-ORIGIN 'RFC4876' )"
add:attributeTypes: add:attributeTypes:"
( 1.3.6.1.4.1.11.1.3.1.1.10 NAME 'credentialLevel' ( 1.3.6.1.4.1.11.1.3.1.1.10 NAME 'credentialLevel'
DESC 'Identifies type of credentials either used, required, DESC 'Identifies type of credentials either used, required,
or supported by an agent or service' or supported by an agent or service'
EQUALITY caseIgnoreIA5Match EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE SINGLE-VALUE
X-ORIGIN 'RFC4876' ) X-ORIGIN 'RFC4876' )"
add:attributeTypes: add:attributeTypes:"
( 1.3.6.1.4.1.11.1.3.1.1.11 NAME 'objectclassMap' ( 1.3.6.1.4.1.11.1.3.1.1.11 NAME 'objectclassMap'
DESC 'Object class mappings used, required, or supported by DESC 'Object class mappings used, required, or supported by
an agent or service' an agent or service'
EQUALITY caseIgnoreIA5Match EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
X-ORIGIN 'RFC4876' ) X-ORIGIN 'RFC4876' )"
add:attributeTypes: add:attributeTypes:
( 1.3.6.1.4.1.11.1.3.1.1.12 NAME 'defaultSearchScope' ( 1.3.6.1.4.1.11.1.3.1.1.12 NAME 'defaultSearchScope'
DESC 'Default scope used when performing a search' DESC 'Default scope used when performing a search'
@@ -99,37 +99,37 @@ add:attributeTypes:
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE SINGLE-VALUE
X-ORIGIN 'RFC4876' ) X-ORIGIN 'RFC4876' )
add:attributeTypes: add:attributeTypes:"
( 1.3.6.1.4.1.11.1.3.1.1.13 NAME 'serviceCredentialLevel' ( 1.3.6.1.4.1.11.1.3.1.1.13 NAME 'serviceCredentialLevel'
DESC 'Specifies the type of credentials either used, required, DESC 'Specifies the type of credentials either used, required,
or supported by a specific service' or supported by a specific service'
EQUALITY caseIgnoreIA5Match EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
X-ORIGIN 'RFC4876' ) X-ORIGIN 'RFC4876' )"
add:attributeTypes: add:attributeTypes:"
( 1.3.6.1.4.1.11.1.3.1.1.14 NAME 'serviceSearchDescriptor' ( 1.3.6.1.4.1.11.1.3.1.1.14 NAME 'serviceSearchDescriptor'
DESC 'Specifies search descriptors required, used, or DESC 'Specifies search descriptors required, used, or
supported by a particular service or agent' supported by a particular service or agent'
EQUALITY caseExactMatch EQUALITY caseExactMatch
SUBSTR caseExactSubstringsMatch SUBSTR caseExactSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
X-ORIGIN 'RFC4876' ) X-ORIGIN 'RFC4876' )"
add:attributeTypes: add:attributeTypes:"
( 1.3.6.1.4.1.11.1.3.1.1.15 NAME 'serviceAuthenticationMethod' ( 1.3.6.1.4.1.11.1.3.1.1.15 NAME 'serviceAuthenticationMethod'
DESC 'Specifies types authentication methods either DESC 'Specifies types authentication methods either
used, required, or supported by a particular service' used, required, or supported by a particular service'
EQUALITY caseIgnoreMatch EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
X-ORIGIN 'RFC4876' ) X-ORIGIN 'RFC4876' )"
add:attributeTypes: add:attributeTypes:"
( 1.3.6.1.4.1.11.1.3.1.1.16 NAME 'dereferenceAliases' ( 1.3.6.1.4.1.11.1.3.1.1.16 NAME 'dereferenceAliases'
DESC 'Specifies if a service or agent either requires, DESC 'Specifies if a service or agent either requires,
supports, or uses dereferencing of aliases.' supports, or uses dereferencing of aliases.'
EQUALITY booleanMatch EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE SINGLE-VALUE
X-ORIGIN 'RFC4876' ) X-ORIGIN 'RFC4876' )"
add:objectClasses: add:objectClasses:
( 1.3.6.1.4.1.11.1.3.1.2.5 NAME 'DUAConfigProfile' ( 1.3.6.1.4.1.11.1.3.1.2.5 NAME 'DUAConfigProfile'
SUP top STRUCTURAL SUP top STRUCTURAL

189
install/updates/40-delegation.update
View File

@@ -66,61 +66,61 @@ add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: addusers add:cn: addusers
add:description: Add Users add:description: Add Users
add:member:"cn=useradmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=useradmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=change_password,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=change_password,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: change_password add:cn: change_password
add:description: Change a user password add:description: Change a user password
add:member:"cn=useradmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=useradmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=add_user_to_default_group,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=add_user_to_default_group,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: add_user_to_default_group add:cn: add_user_to_default_group
add:description: Add user to default group add:description: Add user to default group
add:member:"cn=useradmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=useradmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=removeusers,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=removeusers,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: removeusers add:cn: removeusers
add:description: Remove Users add:description: Remove Users
add:member:"cn=useradmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=useradmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=modifyusers,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=modifyusers,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: modifyusers add:cn: modifyusers
add:description: Modify Users add:description: Modify Users
add:member:"cn=useradmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=useradmin,cn=rolegroups,cn=accounts,$SUFFIX'
# Add the ACIs that grant these permissions for user administration # Add the ACIs that grant these permissions for user administration
dn: $SUFFIX dn: $SUFFIX
add:aci: (target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version add:aci: '(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version
3.0;acl "Add Users";allow (add) groupdn = "ldap:///cn=addusers,cn=taskgroups 3.0;acl "Add Users";allow (add) groupdn = "ldap:///cn=addusers,cn=taskgroups
,cn=accounts,$SUFFIX";) ,cn=accounts,$SUFFIX";)'
add:aci: (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || samb add:aci: '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || samb
aNTPassword || passwordHistory")(version 3.0;acl "change_password";allow (wri aNTPassword || passwordHistory")(version 3.0;acl "change_password";allow (wri
te) groupdn = "ldap:///cn=change_password,cn=taskgroups,cn=accounts,$SUFFIX te) groupdn = "ldap:///cn=change_password,cn=taskgroups,cn=accounts,$SUFFIX
";) ";)'
add:aci: (targetattr = "member")(target = "ldap:///cn=ipausers,cn=groups,cn=accoun add:aci: '(targetattr = "member")(target = "ldap:///cn=ipausers,cn=groups,cn=accoun
ts,$SUFFIX")(version 3.0;acl "Add user to default group";allow (wri ts,$SUFFIX")(version 3.0;acl "Add user to default group";allow (wri
te) groupdn = "ldap:///cn=add_user_to_default_group,cn=taskgroups,cn=accounts te) groupdn = "ldap:///cn=add_user_to_default_group,cn=taskgroups,cn=accounts
,$SUFFIX";) ,$SUFFIX";)'
add:aci: (target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version add:aci: '(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(version
3.0;acl "Remove Users";allow (delete) groupdn = "ldap:///cn=removeusers,cn=t 3.0;acl "Remove Users";allow (delete) groupdn = "ldap:///cn=removeusers,cn=t
askgroups,cn=accounts,$SUFFIX";) askgroups,cn=accounts,$SUFFIX";)'
add:aci: (targetattr = "givenName || sn || cn || displayName || title || initials add:aci: '(targetattr = "givenName || sn || cn || displayName || title || initials
|| loginShell || gecos || homePhone || mobile || pager || facsimileTelephoneN || loginShell || gecos || homePhone || mobile || pager || facsimileTelephoneN
umber || telephoneNumber || street || roomNumber || l || st || postalCode || umber || telephoneNumber || street || roomNumber || l || st || postalCode ||
manager || secretary || description || carLicense || labeledURI || inetUserHT manager || secretary || description || carLicense || labeledURI || inetUserHT
TPURL || seeAlso || employeeType || businessCategory || ou")(target = "ldap:/ TPURL || seeAlso || employeeType || businessCategory || ou")(target = "ldap:/
//uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "Modify User //uid=*,cn=users,cn=accounts,$SUFFIX")(version 3.0;acl "Modify User
s";allow (write) groupdn = "ldap:///cn=modifyusers,cn=taskgroups,cn=accounts, s";allow (write) groupdn = "ldap:///cn=modifyusers,cn=taskgroups,cn=accounts,
$SUFFIX";) $SUFFIX";)'
# Add the taskgroups referenced by the ACIs for group administration # Add the taskgroups referenced by the ACIs for group administration
@@ -129,48 +129,48 @@ add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: addgroups add:cn: addgroups
add:description: Add Groups add:description: Add Groups
add:member:"cn=groupadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=groupadmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=removegroups,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=removegroups,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: removegroups add:cn: removegroups
add:description: Remove Groups add:description: Remove Groups
add:member:"cn=groupadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=groupadmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=modifygroups,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=modifygroups,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: modifygroups add:cn: modifygroups
add:description: Modify Groups add:description: Modify Groups
add:member:"cn=groupadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=groupadmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=modifygroupmembership,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=modifygroupmembership,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: modifygroupmembership add:cn: modifygroupmembership
add:description: Modify Group membership add:description: Modify Group membership
add:member:"cn=groupadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=groupadmin,cn=rolegroups,cn=accounts,$SUFFIX'
# Add the ACIs that grant these permissions for group administration # Add the ACIs that grant these permissions for group administration
dn: $SUFFIX dn: $SUFFIX
add:aci: (target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version add:aci: '(target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version
3.0;acl "Add Groups";allow (add) groupdn = "ldap:///cn=addgroups,cn=taskgroups 3.0;acl "Add Groups";allow (add) groupdn = "ldap:///cn=addgroups,cn=taskgroups
,cn=accounts,$SUFFIX";) ,cn=accounts,$SUFFIX";)'
add:aci: (targetattr = "member")(target = "ldap:///cn=*,cn=groups,cn=accoun add:aci: '(targetattr = "member")(target = "ldap:///cn=*,cn=groups,cn=accoun
ts,$SUFFIX")(version 3.0;acl "Modify group membership";allow (wri ts,$SUFFIX")(version 3.0;acl "Modify group membership";allow (wri
te) groupdn = "ldap:///cn=modifygroupmembership,cn=taskgroups,cn=accounts te) groupdn = "ldap:///cn=modifygroupmembership,cn=taskgroups,cn=accounts
,$SUFFIX";) ,$SUFFIX";)'
add:aci: (target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version add:aci: '(target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version
3.0;acl "Remove Groups";allow (delete) groupdn = "ldap:///cn=removegroups,cn=t 3.0;acl "Remove Groups";allow (delete) groupdn = "ldap:///cn=removegroups,cn=t
askgroups,cn=accounts,$SUFFIX";) askgroups,cn=accounts,$SUFFIX";)'
# we need objectclass and gidnumber in modify so a non-posix group can be # we need objectclass and gidnumber in modify so a non-posix group can be
# promoted # promoted
add:aci: (targetattr = "cn || description || gidnumber || objectclass")(target add:aci: '(targetattr = "cn || description || gidnumber || objectclass")(target
= "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "Modify Group = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "Modify Group
s";allow (write) groupdn = "ldap:///cn=modifygroups,cn=taskgroups,cn=accounts, s";allow (write) groupdn = "ldap:///cn=modifygroups,cn=taskgroups,cn=accounts,
$SUFFIX";) $SUFFIX";)'
# Add the taskgroups referenced by the ACIs for host administration # Add the taskgroups referenced by the ACIs for host administration
@@ -179,35 +179,35 @@ add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: addhosts add:cn: addhosts
add:description: Add Hosts add:description: Add Hosts
add:member:"cn=hostadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=hostadmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=removehosts,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=removehosts,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: removehosts add:cn: removehosts
add:description: Remove Hosts add:description: Remove Hosts
add:member:"cn=hostadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=hostadmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=modifyhosts,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=modifyhosts,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: modifyhosts add:cn: modifyhosts
add:description: Modify Hosts add:description: Modify Hosts
add:member:"cn=hostadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=hostadmin,cn=rolegroups,cn=accounts,$SUFFIX'
# Add the ACIs that grant these permissions for host administration # Add the ACIs that grant these permissions for host administration
dn: $SUFFIX dn: $SUFFIX
add:aci: (target = "ldap:///cn=*,cn=computers,cn=accounts,$SUFFIX")(version add:aci: '(target = "ldap:///cn=*,cn=computers,cn=accounts,$SUFFIX")(version
3.0;acl "Add Hosts";allow (add) groupdn = "ldap:///cn=addhosts,cn=taskgroups 3.0;acl "Add Hosts";allow (add) groupdn = "ldap:///cn=addhosts,cn=taskgroups
,cn=accounts,$SUFFIX";) ,cn=accounts,$SUFFIX";)'
add:aci: (target = "ldap:///cn=*,cn=computers,cn=accounts,$SUFFIX")(version add:aci: '(target = "ldap:///cn=*,cn=computers,cn=accounts,$SUFFIX")(version
3.0;acl "Remove Hosts";allow (delete) groupdn = "ldap:///cn=removehosts,cn= 3.0;acl "Remove Hosts";allow (delete) groupdn = "ldap:///cn=removehosts,cn=
taskgroups,cn=accounts,$SUFFIX";) taskgroups,cn=accounts,$SUFFIX";)'
add:aci: (targetattr = "cn || description || locality || location || platform add:aci: '(targetattr = "cn || description || locality || location || platform
|| os")(target = "ldap:///cn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0; || os")(target = "ldap:///cn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;
acl "Modify Hosts";allow (write) groupdn = "ldap:///cn=modifyhosts, acl "Modify Hosts";allow (write) groupdn = "ldap:///cn=modifyhosts,
cn=taskgroups,cn=accounts,$SUFFIX";) cn=taskgroups,cn=accounts,$SUFFIX";)'
# Add the taskgroups referenced by the ACIs for hostgroup administration # Add the taskgroups referenced by the ACIs for hostgroup administration
@@ -216,46 +216,46 @@ add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: addhostgroups add:cn: addhostgroups
add:description: Add Host Groups add:description: Add Host Groups
add:member:"cn=hostgroupadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=hostgroupadmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=removehostgroups,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=removehostgroups,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: removehostgroups add:cn: removehostgroups
add:description: Remove Host Groups add:description: Remove Host Groups
add:member:"cn=hostgroupadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=hostgroupadmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=modifyhostgroups,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=modifyhostgroups,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: modifyhostgroups add:cn: modifyhostgroups
add:description: Modify Host Groups add:description: Modify Host Groups
add:member:"cn=hostgroupadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=hostgroupadmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=modifyhostgroupmembership,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=modifyhostgroupmembership,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: modifyhostgroupmembership add:cn: modifyhostgroupmembership
add:description: Modify Host Group membership add:description: Modify Host Group membership
add:member:"cn=hostgroupadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=hostgroupadmin,cn=rolegroups,cn=accounts,$SUFFIX'
# Add the ACIs that grant these permissions for hostgroup administration # Add the ACIs that grant these permissions for hostgroup administration
dn: $SUFFIX dn: $SUFFIX
add:aci: (target = "ldap:///cn=*,cn=hostgroups,cn=accounts,$SUFFIX")(version add:aci: '(target = "ldap:///cn=*,cn=hostgroups,cn=accounts,$SUFFIX")(version
3.0;acl "Add Hosts";allow (add) groupdn = "ldap:///cn=addhostgroups,cn= 3.0;acl "Add Hosts";allow (add) groupdn = "ldap:///cn=addhostgroups,cn=
taskgroups,cn=accounts,$SUFFIX";) taskgroups,cn=accounts,$SUFFIX";)'
add:aci: (target = "ldap:///cn=*,cn=hostgroups,cn=accounts,$SUFFIX")(version add:aci: '(target = "ldap:///cn=*,cn=hostgroups,cn=accounts,$SUFFIX")(version
3.0;acl "Remove Hosts";allow (delete) groupdn = "ldap:///cn= 3.0;acl "Remove Hosts";allow (delete) groupdn = "ldap:///cn=
removehostgroups,cn=taskgroups,cn=accounts,$SUFFIX";) removehostgroups,cn=taskgroups,cn=accounts,$SUFFIX";)'
add:aci: (targetattr = "cn || description")(target = "ldap:///cn=*,cn= add:aci: '(targetattr = "cn || description")(target = "ldap:///cn=*,cn=
hostgroups,cn=accounts,$SUFFIX")(version 3.0; acl "Modify Hosts";allow hostgroups,cn=accounts,$SUFFIX")(version 3.0; acl "Modify Hosts";allow
(write) groupdn = "ldap:///cn=modifyhostgroups,cn=taskgroups, (write) groupdn = "ldap:///cn=modifyhostgroups,cn=taskgroups,
cn=accounts,$SUFFIX";) cn=accounts,$SUFFIX";)'
add:aci: (targetattr = "member")(target = "ldap:///cn=*,cn=hostgroups,cn=accoun add:aci: '(targetattr = "member")(target = "ldap:///cn=*,cn=hostgroups,cn=accoun
ts,$SUFFIX")(version 3.0;acl "Modify host group membership";allow (wri ts,$SUFFIX")(version 3.0;acl "Modify host group membership";allow (wri
te) groupdn = "ldap:///cn=modifyhostgroupmembership,cn=taskgroups,cn=accounts te) groupdn = "ldap:///cn=modifyhostgroupmembership,cn=taskgroups,cn=accounts
,$SUFFIX";) ,$SUFFIX";)'
# Add the taskgroups referenced by the ACIs for service administration # Add the taskgroups referenced by the ACIs for service administration
@@ -264,24 +264,24 @@ add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: addservices add:cn: addservices
add:description: Add Services add:description: Add Services
add:member:"cn=serviceadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=serviceadmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=removeservices,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=removeservices,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: removeservices add:cn: removeservices
add:description: Remove Services add:description: Remove Services
add:member:"cn=serviceadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=serviceadmin,cn=rolegroups,cn=accounts,$SUFFIX'
# Add the ACIs that grant these permissions for service administration # Add the ACIs that grant these permissions for service administration
dn: $SUFFIX dn: $SUFFIX
add:aci: (target = "ldap:///krbprincipalname=*,cn=services,cn=accounts, add:aci: '(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,
$SUFFIX")(version 3.0;acl "Add Services";allow (add) groupdn = "ldap:///cn $SUFFIX")(version 3.0;acl "Add Services";allow (add) groupdn = "ldap:///cn
=addservices,cn=taskgroups,cn=accounts,$SUFFIX";) =addservices,cn=taskgroups,cn=accounts,$SUFFIX";)'
add:aci: (target = "ldap:///krbprincipalname=*,cn=services,cn=accounts, add:aci: '(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,
$SUFFIX")(version 3.0;acl "Remove Services";allow (delete) groupdn = "ldap $SUFFIX")(version 3.0;acl "Remove Services";allow (delete) groupdn = "ldap
:///cn=removeservices,cn=taskgroups,cn=accounts,$SUFFIX";) :///cn=removeservices,cn=taskgroups,cn=accounts,$SUFFIX";)'
# Add the taskgroups referenced by the ACIs for delegation administration # Add the taskgroups referenced by the ACIs for delegation administration
# This just lets one manage taskgroup membership and create and delete roles # This just lets one manage taskgroup membership and create and delete roles
@@ -291,56 +291,56 @@ add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: addhrole add:cn: addhrole
add:description: Add Roles add:description: Add Roles
add:member:"cn=delegationadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=delegationadmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=removeroles,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=removeroles,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: removeroles add:cn: removeroles
add:description: Remove Roles add:description: Remove Roles
add:member:"cn=delegationadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=delegationadmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=modifyroles,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=modifyroles,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: modifyroles add:cn: modifyroles
add:description: Modify Roles add:description: Modify Roles
add:member:"cn=delegationadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=delegationadmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=modifyrolegroupmembership,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=modifyrolegroupmembership,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: modifyrolegroupmembership add:cn: modifyrolegroupmembership
add:description: Modify Role Group membership add:description: Modify Role Group membership
add:member:"cn=delegationadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=delegationadmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=modifytaskgroupmembership,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=modifytaskgroupmembership,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: modifytaskgroupmembership add:cn: modifytaskgroupmembership
add:description: Modify Task Group membership add:description: Modify Task Group membership
add:member:"cn=delegationadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=delegationadmin,cn=rolegroups,cn=accounts,$SUFFIX'
# Add the ACIs that grant these permissions for delegation administration # Add the ACIs that grant these permissions for delegation administration
dn: $SUFFIX dn: $SUFFIX
add:aci: (target = "ldap:///cn=*,cn=rolegroups,cn=accounts,$SUFFIX")(version add:aci: '(target = "ldap:///cn=*,cn=rolegroups,cn=accounts,$SUFFIX")(version
3.0;acl "Add Roles";allow (add) groupdn = "ldap:///cn=addroles,cn=taskgroups 3.0;acl "Add Roles";allow (add) groupdn = "ldap:///cn=addroles,cn=taskgroups
,cn=accounts,$SUFFIX";) ,cn=accounts,$SUFFIX";)'
add:aci: (target = "ldap:///cn=*,cn=rolegroups,cn=accounts,$SUFFIX")(version add:aci: '(target = "ldap:///cn=*,cn=rolegroups,cn=accounts,$SUFFIX")(version
3.0;acl "Remove Roles";allow (delete) groupdn = "ldap:///cn=removeroles,cn= 3.0;acl "Remove Roles";allow (delete) groupdn = "ldap:///cn=removeroles,cn=
taskgroups,cn=accounts,$SUFFIX";) taskgroups,cn=accounts,$SUFFIX";)'
add:aci: (targetattr = "cn || description")(target = "ldap:///cn=*,cn=rolegro add:aci: '(targetattr = "cn || description")(target = "ldap:///cn=*,cn=rolegro
ups,cn=accounts,$SUFFIX")(version 3.0; acl "Modify Roles";allow (write) grou ups,cn=accounts,$SUFFIX")(version 3.0; acl "Modify Roles";allow (write) grou
pdn = "ldap:///cn=modifyroles,cn=taskgroups,cn=accounts,$SUFFIX";) pdn = "ldap:///cn=modifyroles,cn=taskgroups,cn=accounts,$SUFFIX";)'
add:aci: (targetattr = "member")(target = "ldap:///cn=*,cn=rolegroups,cn=accoun add:aci: '(targetattr = "member")(target = "ldap:///cn=*,cn=rolegroups,cn=accoun
ts,$SUFFIX")(version 3.0;acl "Modify role group membership";allow (wri ts,$SUFFIX")(version 3.0;acl "Modify role group membership";allow (wri
te) groupdn = "ldap:///cn=modifyrolegroupmembership,cn=taskgroups,cn=accounts te) groupdn = "ldap:///cn=modifyrolegroupmembership,cn=taskgroups,cn=accounts
,$SUFFIX";) ,$SUFFIX";)'
add:aci: (targetattr = "member")(target = "ldap:///cn=*,cn=taskgroups,cn=accoun add:aci: '(targetattr = "member")(target = "ldap:///cn=*,cn=taskgroups,cn=accoun
ts,$SUFFIX")(version 3.0;acl "Modify task group membership";allow (wri ts,$SUFFIX")(version 3.0;acl "Modify task group membership";allow (wri
te) groupdn = "ldap:///cn=modifytaskgroupmembership,cn=taskgroups,cn=accounts te) groupdn = "ldap:///cn=modifytaskgroupmembership,cn=taskgroups,cn=accounts
,$SUFFIX";) ,$SUFFIX";)'
# Add the taskgroups referenced by the ACIs for automount administration # Add the taskgroups referenced by the ACIs for automount administration
@@ -349,30 +349,30 @@ add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: addautomount add:cn: addautomount
add:description: Add Automount maps/keys add:description: Add Automount maps/keys
add:member:"cn=automountadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=automountadmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=removeautomount,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=removeautomount,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: removeautomount add:cn: removeautomount
add:description: Remove Automount maps/keys add:description: Remove Automount maps/keys
add:member:"cn=automountadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=automountadmin,cn=rolegroups,cn=accounts,$SUFFIX'
# Add the ACIs that grant these permissions for service administration # Add the ACIs that grant these permissions for service administration
dn: $SUFFIX dn: $SUFFIX
add:aci: (target = "ldap:///automountmapname=*,cn=automount, add:aci: '(target = "ldap:///automountmapname=*,cn=automount,
$SUFFIX")(version 3.0;acl "Add automount maps";allow (add) groupdn = "ldap $SUFFIX")(version 3.0;acl "Add automount maps";allow (add) groupdn = "ldap
:///cn=addautomount,cn=taskgroups,cn=accounts,$SUFFIX";) :///cn=addautomount,cn=taskgroups,cn=accounts,$SUFFIX";)'
add:aci: (target = "ldap:///automountmapname=*,cn=automount, add:aci: '(target = "ldap:///automountmapname=*,cn=automount,
$SUFFIX")(version 3.0;acl "Remove automount maps";allow (delete) groupdn = $SUFFIX")(version 3.0;acl "Remove automount maps";allow (delete) groupdn =
"ldap:///cn=removeautomount,cn=taskgroups,cn=accounts,$SUFFIX";) "ldap:///cn=removeautomount,cn=taskgroups,cn=accounts,$SUFFIX";)'
add:aci: (target = "ldap:///automountkey=*,automountmapname=*,cn=automount, add:aci: '(target = "ldap:///automountkey=*,automountmapname=*,cn=automount,
$SUFFIX")(version 3.0;acl "Add automount keys";allow (add) groupdn = "ldap $SUFFIX")(version 3.0;acl "Add automount keys";allow (add) groupdn = "ldap
:///cn=addautomount,cn=taskgroups,cn=accounts,$SUFFIX";) :///cn=addautomount,cn=taskgroups,cn=accounts,$SUFFIX";)'
add:aci: (target = "ldap:///automountkey=*,automountmapname=*,cn=automount, add:aci: '(target = "ldap:///automountkey=*,automountmapname=*,cn=automount,
$SUFFIX")(version 3.0;acl "Remove automount keys";allow (delete) groupdn = $SUFFIX")(version 3.0;acl "Remove automount keys";allow (delete) groupdn =
"ldap:///cn=removeautomount,cn=taskgroups,cn=accounts,$SUFFIX";) "ldap:///cn=removeautomount,cn=taskgroups,cn=accounts,$SUFFIX";)'
# Add the taskgroups referenced by the ACIs for netgroup administration # Add the taskgroups referenced by the ACIs for netgroup administration
@@ -381,45 +381,45 @@ add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: addnetgroups add:cn: addnetgroups
add:description: Add netgroups add:description: Add netgroups
add:member:"cn=netgroupadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=netgroupadmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=removenetgroups,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=removenetgroups,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: removenetgroups add:cn: removenetgroups
add:description: Remove netgroups add:description: Remove netgroups
add:member:"cn=netgroupadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=netgroupadmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=modifynetgroups,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=modifynetgroups,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: modifynetgroups add:cn: modifynetgroups
add:description: Modify netgroups add:description: Modify netgroups
add:member:"cn=netgroupadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=netgroupadmin,cn=rolegroups,cn=accounts,$SUFFIX'
dn: cn=modifynetgroupmembership,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=modifynetgroupmembership,cn=taskgroups,cn=accounts,$SUFFIX
add:objectClass: top add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: modifynetgroupmembership add:cn: modifynetgroupmembership
add:description: Modify netgroup membership add:description: Modify netgroup membership
add:member:"cn=netgroupadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=netgroupadmin,cn=rolegroups,cn=accounts,$SUFFIX'
# Add the ACIs that grant these permissions for netgroup administration # Add the ACIs that grant these permissions for netgroup administration
dn: $SUFFIX dn: $SUFFIX
add:aci: (target = "ldap:///ipauniqueid=*,cn=ng,cn=alt,$SUFFIX")(version add:aci: '(target = "ldap:///ipauniqueid=*,cn=ng,cn=alt,$SUFFIX")(version
3.0;acl "Add netgroups";allow (add) groupdn = "ldap:///cn=addnetgroups,cn= 3.0;acl "Add netgroups";allow (add) groupdn = "ldap:///cn=addnetgroups,cn=
taskgroups,cn=accounts,$SUFFIX";) taskgroups,cn=accounts,$SUFFIX";)'
add:aci: (target = "ldap:///ipauniqueid=*,cn=ng,cn=alt,$SUFFIX")(version add:aci: '(target = "ldap:///ipauniqueid=*,cn=ng,cn=alt,$SUFFIX")(version
3.0;acl "Remove netgroups";allow (delete) groupdn = "ldap:///cn= 3.0;acl "Remove netgroups";allow (delete) groupdn = "ldap:///cn=
removenetgroups,cn=taskgroups,cn=accounts,$SUFFIX";) removenetgroups,cn=taskgroups,cn=accounts,$SUFFIX";)'
add:aci: (targetattr = "description")(target = "ldap:///ipauniqueid=*,cn=ng, add:aci: '(targetattr = "description")(target = "ldap:///ipauniqueid=*,cn=ng,
cn=alt,$SUFFIX")(version 3.0; acl "Modify netgroups";allow (write) groupdn cn=alt,$SUFFIX")(version 3.0; acl "Modify netgroups";allow (write) groupdn
= "ldap:///cn=modifynetgroups,cn=taskgroups,cn=accounts,$SUFFIX";) = "ldap:///cn=modifynetgroups,cn=taskgroups,cn=accounts,$SUFFIX";)'
add:aci: (targetattr = "memberhost || externalhost || memberuser || member") add:aci: '(targetattr = "memberhost || externalhost || memberuser || member")
(target = "ldap:///ipauniqueid=*,cn=ng,cn=alt,$SUFFIX")(version 3.0;acl "Mo (target = "ldap:///ipauniqueid=*,cn=ng,cn=alt,$SUFFIX")(version 3.0;acl "Mo
dify netgroup membership";allow (write) groupdn = "ldap:///cn=modifynetgrou dify netgroup membership";allow (write) groupdn = "ldap:///cn=modifynetgrou
pmembership,cn=taskgroups,cn=accounts,$SUFFIX";) pmembership,cn=taskgroups,cn=accounts,$SUFFIX";)'
# Taskgroup for retrieving host keytabs # Taskgroup for retrieving host keytabs
dn: cn=manage_host_keytab,cn=taskgroups,cn=accounts,$SUFFIX dn: cn=manage_host_keytab,cn=taskgroups,cn=accounts,$SUFFIX
@@ -427,11 +427,12 @@ add:objectClass: top
add:objectClass: groupofnames add:objectClass: groupofnames
add:cn: manage_host_keytab add:cn: manage_host_keytab
add:description: Manage host keytab add:description: Manage host keytab
add:member:"cn=hostadmin,cn=rolegroups,cn=accounts,$SUFFIX" add:member:'cn=hostadmin,cn=rolegroups,cn=accounts,$SUFFIX'
# Add the ACI needed to do host keytab admin # Add the ACI needed to do host keytab admin
add:aci: (targetattr = "krbPrincipalKey")(target = "ldap:///cn=*, dn: $SUFFIX
add:aci: '(targetattr = "krbPrincipalKey")(target = "ldap:///cn=*,
cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "Manage host keytab"; cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "Manage host keytab";
allow (write) groupdn = "ldap:///cn=manage_host_keytab,cn=taskgroups, allow (write) groupdn = "ldap:///cn=manage_host_keytab,cn=taskgroups,
cn=accounts,$SUFFIX";) cn=accounts,$SUFFIX";)'