IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

schema-compat: set precedence to 49 to allow OTP binds over compat tree

Browse Source 
schema-compat plugin rewrites bind DN to point to the original entry
on LDAP bind operation. To work with OTP tokens this requires that
schema-compat's pre-bind callback is called before pre-bind callback of
the ipa-pwd-extop plugin. Therefore, schema-compat plugin should have
a nsslapd-pluginprecedence value lower than (default) 50 which is used
by the ipa-pwd-extop plugin.

Note that this will only work if ticket 47699 is fixed in 389-ds.

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
This commit is contained in:
Alexander Bokovoy
2014-02-20 12:18:16 +02:00
committed by Martin Kosek
parent 480eba26a1
commit ad6480f845
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
install/share/schema_compat.uldif
View File

@@ -13,6 +13,10 @@ default:nsslapd-plugininitfunc: schema_compat_plugin_init
default:nsslapd-plugintype: object default:nsslapd-plugintype: object
default:nsslapd-pluginenabled: on default:nsslapd-pluginenabled: on
default:nsslapd-pluginid: schema-compat-plugin default:nsslapd-pluginid: schema-compat-plugin
# We need to run schema-compat pre-bind callback before
# other IPA pre-bind callbacks to make sure bind DN is
# rewritten to the original entry if needed
default:nsslapd-pluginprecedence: 49
default:nsslapd-pluginversion: 0.8 default:nsslapd-pluginversion: 0.8
default:nsslapd-pluginbetxn: on default:nsslapd-pluginbetxn: on
default:nsslapd-pluginvendor: redhat.com default:nsslapd-pluginvendor: redhat.com

7
install/updates/10-schema_compat.update
View File

@@ -23,3 +23,10 @@ default:schema-compat-entry-attribute: macAddress=%{macAddress}
dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config
add:schema-compat-entry-attribute: sudoOrder=%{sudoOrder} add:schema-compat-entry-attribute: sudoOrder=%{sudoOrder}
dn: cn=Schema Compatibility,cn=plugins,cn=config
# We need to run schema-compat pre-bind callback before
# other IPA pre-bind callbacks to make sure bind DN is
# rewritten to the original entry if needed
add:nsslapd-pluginprecedence: 49