IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Set nsslapd-minssf-exclude-rootdse to on so the DSE is always available.

Browse Source 
If minssf is set in configuration and this is not set then clients won't
be able to detect the available namingContexts, defaultNamingContext,
capabilities, etc.

https://fedorahosted.org/freeipa/ticket/2542
This commit is contained in:
Rob Crittenden
2012-03-22 17:19:01 -04:00
committed by Martin Kosek
parent 00ce15b744
commit a735420a9b
2 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
install/updates/10-config.update
View File

@@ -38,3 +38,7 @@ only:nsslapd-anonlimitsdn:'cn=anonymous-limits,cn=etc,$SUFFIX'
# doesn't support it generates a non-fatal error.
dn: cn=config
add:nsslapd-defaultNamingContext:'$SUFFIX'
# Allow the root DSE to be searched even with minssf set
dn: cn=config
only:nsslapd-minssf-exclude-rootdse:on

2
ipaserver/ipaldap.py
View File

@@ -540,7 +540,7 @@ class IPAdmin(IPAEntryLDAPObject):
# Some attributes, like those in cn=config, need to be replaced
# not deleted/added.
FORCE_REPLACE_ON_UPDATE_ATTRS = ('nsslapd-ssl-check-hostname', 'nsslapd-lookthroughlimit', 'nsslapd-idlistscanlimit', 'nsslapd-anonlimitsdn')
FORCE_REPLACE_ON_UPDATE_ATTRS = ('nsslapd-ssl-check-hostname', 'nsslapd-lookthroughlimit', 'nsslapd-idlistscanlimit', 'nsslapd-anonlimitsdn', 'nsslapd-minssf-exclude-rootdse')
modlist = []
old_entry = ipautil.CIDict(old_entry)