mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-01-26 16:16:31 -06:00
Convert Host default permissions to managed
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
This commit is contained in:
Petr Viktorin
parent
ac8539bd34
commit
8a5110305f
14
ACI.txt
14
ACI.txt
@ -38,10 +38,24 @@ dn: cn=System: Read HBAC Services,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
aci: (targetattr = "cn || description || ipauniqueid || memberof || objectclass")(targetfilter = "(objectclass=ipahbacservice)")(version 3.0;acl "permission:System: Read HBAC Services";allow (compare,read,search) userdn = "ldap:///all";)
|
||||
dn: cn=System: Read HBAC Service Groups,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
aci: (targetattr = "businesscategory || cn || description || ipauniqueid || member || memberhost || memberuser || o || objectclass || ou || owner || seealso")(targetfilter = "(objectclass=ipahbacservicegroup)")(version 3.0;acl "permission:System: Read HBAC Service Groups";allow (compare,read,search) userdn = "ldap:///all";)
|
||||
dn: cn=System: Add Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
aci: (targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Add Hosts";allow (add) groupdn = "ldap:///cn=System: Add Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
aci: (targetattr = "krbprincipalname")(targetfilter = "(&(!(krbprincipalname=*))(objectclass=ipahost))")(version 3.0;acl "permission:System: Add krbPrincipalName to a Host";allow (write) groupdn = "ldap:///cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
aci: (targetattr = "enrolledby || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Enroll a Host";allow (write) groupdn = "ldap:///cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
aci: (targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
aci: (targetattr = "ipasshpubkey")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
aci: (targetattr = "description || l || macaddress || nshardwareplatform || nshostlocation || nsosversion")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Modify Hosts";allow (write) groupdn = "ldap:///cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=System: Read Host Membership,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
aci: (targetattr = "memberof")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Host Membership";allow (compare,read,search) userdn = "ldap:///all";)
|
||||
dn: cn=System: Read Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
aci: (targetattr = "cn || description || enrolledby || fqdn || ipaclientversion || ipakrbauthzdata || ipasshpubkey || ipauniqueid || krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalexpiration || krbprincipalname || l || macaddress || managedby || nshardwareplatform || nshostlocation || nsosversion || objectclass || serverhostname || usercertificate || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Hosts";allow (compare,read,search) userdn = "ldap:///all";)
|
||||
dn: cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
aci: (targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Remove Hosts";allow (delete) groupdn = "ldap:///cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=System: Read Hostgroup Membership,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
aci: (targetattr = "member || memberhost || memberof || memberuser")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Read Hostgroup Membership";allow (compare,read,search) userdn = "ldap:///all";)
|
||||
dn: cn=System: Read Hostgroups,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
|
||||
@ -167,40 +167,6 @@ objectClass: ipapermission
|
||||
cn: Modify Group membership
|
||||
member: cn=Group Administrators,cn=privileges,cn=pbac,$SUFFIX
|
||||
|
||||
# Host administration
|
||||
|
||||
dn: cn=Add Hosts,cn=permissions,cn=pbac,$SUFFIX
|
||||
changetype: add
|
||||
objectClass: top
|
||||
objectClass: groupofnames
|
||||
objectClass: ipapermission
|
||||
cn: Add Hosts
|
||||
member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
|
||||
|
||||
dn: cn=Remove Hosts,cn=permissions,cn=pbac,$SUFFIX
|
||||
changetype: add
|
||||
objectClass: top
|
||||
objectClass: groupofnames
|
||||
objectClass: ipapermission
|
||||
cn: Remove Hosts
|
||||
member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
|
||||
|
||||
dn: cn=Modify Hosts,cn=permissions,cn=pbac,$SUFFIX
|
||||
changetype: add
|
||||
objectClass: top
|
||||
objectClass: groupofnames
|
||||
objectClass: ipapermission
|
||||
cn: Modify Hosts
|
||||
member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
|
||||
|
||||
dn: cn=Manage Host SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX
|
||||
changetype: add
|
||||
objectClass: top
|
||||
objectClass: groupofnames
|
||||
objectClass: ipapermission
|
||||
cn: Manage Host SSH Public Keys
|
||||
member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
|
||||
|
||||
# Hostgroup administration
|
||||
|
||||
dn: cn=Add Hostgroups,cn=permissions,cn=pbac,$SUFFIX
|
||||
@ -387,17 +353,6 @@ objectClass: ipapermission
|
||||
cn: Modify netgroup membership
|
||||
member: cn=Netgroups Administrators,cn=privileges,cn=pbac,$SUFFIX
|
||||
|
||||
# Keytab access
|
||||
|
||||
dn: cn=Manage host keytab,cn=permissions,cn=pbac,$SUFFIX
|
||||
changetype: add
|
||||
objectClass: top
|
||||
objectClass: groupofnames
|
||||
objectClass: ipapermission
|
||||
cn: Manage host keytab
|
||||
member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
|
||||
member: cn=Host Enrollment,cn=privileges,cn=pbac,$SUFFIX
|
||||
|
||||
dn: cn=Manage service keytab,cn=permissions,cn=pbac,$SUFFIX
|
||||
changetype: add
|
||||
objectClass: top
|
||||
@ -411,15 +366,6 @@ member: cn=admins,cn=groups,cn=accounts,$SUFFIX
|
||||
|
||||
# The permission and aci for this is in install/updates/dns.ldif
|
||||
|
||||
dn: cn=Enroll a host,cn=permissions,cn=pbac,$SUFFIX
|
||||
changetype: add
|
||||
objectClass: top
|
||||
objectClass: groupofnames
|
||||
objectClass: ipapermission
|
||||
cn: Enroll a host
|
||||
member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
|
||||
member: cn=Host Enrollment,cn=privileges,cn=pbac,$SUFFIX
|
||||
|
||||
# Replica administration
|
||||
|
||||
dn: cn=Add Replication Agreements,cn=permissions,cn=pbac,$SUFFIX
|
||||
@ -474,16 +420,6 @@ aci: (target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "pe
|
||||
# promoted. We need mqpManagedBy and ipaUniqueId so a group can be detached.
|
||||
aci: (targetattr = "cn || description || gidnumber || objectclass || mepmanagedby || ipauniqueid")(target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Groups";allow (write) groupdn = "ldap:///cn=Modify Groups,cn=permissions,cn=pbac,$SUFFIX";)
|
||||
|
||||
# Host administration
|
||||
|
||||
dn: $SUFFIX
|
||||
changetype: modify
|
||||
add: aci
|
||||
aci: (target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Add Hosts";allow (add) groupdn = "ldap:///cn=Add Hosts,cn=permissions,cn=pbac,$SUFFIX";)
|
||||
aci: (target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Remove Hosts";allow (delete) groupdn = "ldap:///cn=Remove Hosts,cn=permissions,cn=pbac,$SUFFIX";)
|
||||
aci: (targetattr = "description || l || nshostlocation || nshardwareplatform || nsosversion")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Hosts";allow (write) groupdn = "ldap:///cn=Modify Hosts,cn=permissions,cn=pbac,$SUFFIX";)
|
||||
aci: (targetattr = "ipasshpubkey")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=Manage Host SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX";)
|
||||
|
||||
# Hostgroup administration
|
||||
|
||||
dn: $SUFFIX
|
||||
@ -536,13 +472,6 @@ aci: (target = "ldap:///ipauniqueid=*,cn=ng,cn=alt,$SUFFIX")(version 3.0;acl "pe
|
||||
aci: (targetattr = "description")(target = "ldap:///ipauniqueid=*,cn=ng,cn=alt,$SUFFIX")(version 3.0; acl "permission:Modify netgroups";allow (write) groupdn = "ldap:///cn=Modify netgroups,cn=permissions,cn=pbac,$SUFFIX";)
|
||||
aci: (targetattr = "memberhost || externalhost || memberuser || member")(target = "ldap:///ipauniqueid=*,cn=ng,cn=alt,$SUFFIX")(version 3.0;acl "permission:Modify netgroup membership";allow (write) groupdn = "ldap:///cn=Modify netgroup membership,cn=permissions,cn=pbac,$SUFFIX";)
|
||||
|
||||
# Host keytab admin
|
||||
|
||||
dn: $SUFFIX
|
||||
changetype: modify
|
||||
add: aci
|
||||
aci: (targetattr = "krbprincipalkey || krblastpwdchange")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage host keytab";allow (write) groupdn = "ldap:///cn=Manage host keytab,cn=permissions,cn=pbac,$SUFFIX";)
|
||||
|
||||
# Service keytab admin
|
||||
|
||||
dn: $SUFFIX
|
||||
@ -550,17 +479,6 @@ changetype: modify
|
||||
add: aci
|
||||
aci: (targetattr = "krbprincipalkey || krblastpwdchange")(target = "ldap:///krbprincipalname=*,cn=services,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage service keytab";allow (write) groupdn = "ldap:///cn=Manage service keytab,cn=permissions,cn=pbac,$SUFFIX";)
|
||||
|
||||
# Add the ACI needed to do host enrollment. When this occurs we
|
||||
# set the krbPrincipalName, add krbPrincipalAux to objectClass and
|
||||
# set enrolledBy to whoever ran join. enrolledBy is specifically
|
||||
# not listed here, it is set by the plugin but we don't want an
|
||||
# admin overriding it using --setattr or ldapmodify.
|
||||
|
||||
dn: $SUFFIX
|
||||
changetype: modify
|
||||
add: aci
|
||||
aci: (targetattr = "objectclass")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Enroll a host";allow (write) groupdn = "ldap:///cn=Enroll a host,cn=permissions,cn=pbac,$SUFFIX";)
|
||||
|
||||
# Create virtual operations entry. This is used to control access to
|
||||
# operations that don't rely on LDAP directly.
|
||||
dn: cn=virtual operations,cn=etc,$SUFFIX
|
||||
|
||||
@ -170,28 +170,9 @@ default:objectClass: top
|
||||
default:cn: Password Policy Administrator
|
||||
default:description: Password Policy Administrator
|
||||
|
||||
# Allow an admin to enroll a host that has a one-time password.
|
||||
# When a host is created with a password no krbPrincipalName is set.
|
||||
# This will let it be added if the client ends up enrolling with
|
||||
# an administrator instead.
|
||||
dn: cn=Add krbPrincipalName to a host,cn=permissions,cn=pbac,$SUFFIX
|
||||
default:objectClass: top
|
||||
default:objectClass: groupofnames
|
||||
default:objectClass: ipapermission
|
||||
default:cn: Add krbPrincipalName to a host
|
||||
default:member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
|
||||
default:member: cn=Host Enrollment,cn=privileges,cn=pbac,$SUFFIX
|
||||
|
||||
dn: $SUFFIX
|
||||
add:aci: '(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(targetfilter = "(!(krbprincipalname=*))")(targetattr = "krbprincipalname")(version 3.0;acl "permission:Add krbPrincipalName to a host"; allow (write) groupdn = "ldap:///cn=Add krbPrincipalName to a host,cn=permissions,cn=pbac,$SUFFIX";)'
|
||||
|
||||
dn: cn=Host Enrollment,cn=privileges,cn=pbac,$SUFFIX
|
||||
add:member: 'cn=admins,cn=groups,cn=accounts,$SUFFIX'
|
||||
|
||||
# Don't allow admins to update enrolledBy
|
||||
dn: $SUFFIX
|
||||
replace:aci:'(targetattr = "enrolledby || objectclass")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Enroll a host";allow (write) groupdn = "ldap:///cn=Enroll a host,cn=permissions,cn=pbac,$SUFFIX";)::(targetattr = "objectclass")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Enroll a host";allow (write) groupdn = "ldap:///cn=Enroll a host,cn=permissions,cn=pbac,$SUFFIX";)'
|
||||
|
||||
# The original DNS permissions lacked the tag.
|
||||
dn: $SUFFIX
|
||||
remove:aci:'(target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "Add DNS entries";allow (add) groupdn = "ldap:///cn=add dns entries,cn=permissions,cn=pbac,$SUFFIX";)'
|
||||
@ -257,16 +238,7 @@ add:aci:'(targetattr = "automountkey || automountinformation || description")(ta
|
||||
replace:aci:'(target = "ldap:///automountkey=*,automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Add Automount keys";allow (add) groupdn = "ldap:///cn=Add Automount keys,cn=permissions,cn=pbac,$SUFFIX";)::(targetfilter = "(objectclass=automount)")(target = "ldap:///automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Add Automount keys";allow (add) groupdn = "ldap:///cn=Add Automount keys,cn=permissions,cn=pbac,$SUFFIX";)'
|
||||
replace:aci:'(target = "ldap:///automountkey=*,automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Remove Automount keys";allow (delete) groupdn = "ldap:///cn=Remove Automount keys,cn=permissions,cn=pbac,$SUFFIX";)::(targetfilter = "(objectclass=automount)")(target = "ldap:///automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Remove Automount keys";allow (delete) groupdn = "ldap:///cn=Remove Automount keys,cn=permissions,cn=pbac,$SUFFIX";)'
|
||||
|
||||
dn: cn=Manage Host SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX
|
||||
default:objectClass: top
|
||||
default:objectClass: groupofnames
|
||||
default:objectClass: ipapermission
|
||||
default:cn: Manage Host SSH Public Keys
|
||||
default:member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
|
||||
|
||||
dn: $SUFFIX
|
||||
add:aci:'(targetattr = "ipasshpubkey")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=Manage Host SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX";)'
|
||||
|
||||
# Don't allow the default 'manage group membership' to be able to manage the
|
||||
# admins group
|
||||
replace:aci:'(targetattr = "member")(target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Group membership";allow (write) groupdn = "ldap:///cn=Modify Group membership,cn=permissions,cn=pbac,$SUFFIX";)::(targetfilter = "(!(cn=admins))")(targetattr = "member")(target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Group membership";allow (write) groupdn = "ldap:///cn=Modify Group membership,cn=permissions,cn=pbac,$SUFFIX";)'
|
||||
@ -283,6 +255,7 @@ add: member: 'cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX'
|
||||
dn: cn=Revoke Certificate,cn=permissions,cn=pbac,$SUFFIX
|
||||
add: member: 'cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX'
|
||||
|
||||
|
||||
# Automember tasks
|
||||
dn: cn=Automember Task Administrator,cn=privileges,cn=pbac,$SUFFIX
|
||||
default:objectClass: nestedgroup
|
||||
|
||||
@ -290,6 +290,72 @@ class host(LDAPObject):
|
||||
'memberof',
|
||||
},
|
||||
},
|
||||
'System: Add Hosts': {
|
||||
'ipapermright': {'add'},
|
||||
'replaces': [
|
||||
'(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Add Hosts";allow (add) groupdn = "ldap:///cn=Add Hosts,cn=permissions,cn=pbac,$SUFFIX";)',
|
||||
],
|
||||
'default_privileges': {'Host Administrators'},
|
||||
},
|
||||
'System: Add krbPrincipalName to a Host': {
|
||||
# Allow an admin to enroll a host that has a one-time password.
|
||||
# When a host is created with a password no krbPrincipalName is set.
|
||||
# This will let it be added if the client ends up enrolling with
|
||||
# an administrator instead.
|
||||
'ipapermright': {'write'},
|
||||
'ipapermtargetfilter': [
|
||||
'(objectclass=ipahost)',
|
||||
'(!(krbprincipalname=*))',
|
||||
],
|
||||
'ipapermdefaultattr': {'krbprincipalname'},
|
||||
'replaces': [
|
||||
'(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(targetfilter = "(!(krbprincipalname=*))")(targetattr = "krbprincipalname")(version 3.0;acl "permission:Add krbPrincipalName to a host"; allow (write) groupdn = "ldap:///cn=Add krbPrincipalName to a host,cn=permissions,cn=pbac,$SUFFIX";)',
|
||||
],
|
||||
'default_privileges': {'Host Administrators', 'Host Enrollment'},
|
||||
},
|
||||
'System: Enroll a Host': {
|
||||
'ipapermright': {'write'},
|
||||
'ipapermdefaultattr': {'objectclass', 'enrolledby'},
|
||||
'replaces': [
|
||||
'(targetattr = "objectclass")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Enroll a host";allow (write) groupdn = "ldap:///cn=Enroll a host,cn=permissions,cn=pbac,$SUFFIX";)',
|
||||
'(targetattr = "enrolledby || objectclass")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Enroll a host";allow (write) groupdn = "ldap:///cn=Enroll a host,cn=permissions,cn=pbac,$SUFFIX";)',
|
||||
],
|
||||
'default_privileges': {'Host Administrators', 'Host Enrollment'},
|
||||
},
|
||||
'System: Manage Host SSH Public Keys': {
|
||||
'ipapermright': {'write'},
|
||||
'ipapermdefaultattr': {'ipasshpubkey'},
|
||||
'replaces': [
|
||||
'(targetattr = "ipasshpubkey")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=Manage Host SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX";)',
|
||||
],
|
||||
'default_privileges': {'Host Administrators'},
|
||||
},
|
||||
'System: Manage Host Keytab': {
|
||||
'ipapermright': {'write'},
|
||||
'ipapermdefaultattr': {'krblastpwdchange', 'krbprincipalkey'},
|
||||
'replaces': [
|
||||
'(targetattr = "krbprincipalkey || krblastpwdchange")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage host keytab";allow (write) groupdn = "ldap:///cn=Manage host keytab,cn=permissions,cn=pbac,$SUFFIX";)',
|
||||
],
|
||||
'default_privileges': {'Host Administrators', 'Host Enrollment'},
|
||||
},
|
||||
'System: Modify Hosts': {
|
||||
'ipapermright': {'write'},
|
||||
'ipapermdefaultattr': {
|
||||
'description', 'l', 'nshardwareplatform', 'nshostlocation',
|
||||
'nsosversion', 'macaddress',
|
||||
},
|
||||
'replaces': [
|
||||
'(targetattr = "description || l || nshostlocation || nshardwareplatform || nsosversion")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Hosts";allow (write) groupdn = "ldap:///cn=Modify Hosts,cn=permissions,cn=pbac,$SUFFIX";)',
|
||||
],
|
||||
'default_privileges': {'Host Administrators'},
|
||||
},
|
||||
'System: Remove Hosts': {
|
||||
'ipapermright': {'delete'},
|
||||
'replaces': [
|
||||
'(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Remove Hosts";allow (delete) groupdn = "ldap:///cn=Remove Hosts,cn=permissions,cn=pbac,$SUFFIX";)',
|
||||
],
|
||||
'default_privileges': {'Host Administrators'},
|
||||
},
|
||||
}
|
||||
|
||||
label = _('Hosts')
|
||||
|
||||
Loading…
Reference in New Issue
Block a user