9 Commits

Author	SHA1	Message	Date
Fraser Tweedale	0e9ce73a52	Add uniqueness constraint on CA ACL name ... It is possible to add caacl entries with same "name" (cn). The command is supposed to prevent this but direct LDAP operations allow it and doing that will cause subsequent errors. Enable the DS uniqueness constraint plugin for the cn attribute in CA ACL entries. Fixes: https://pagure.io/freeipa/issue/7304 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>	2017-12-12 14:36:44 +01:00
Martin Basti	98e4c6d6de	Uid uniqueness: fix: exclude compat tree from uniqueness ... Without this commit it is not possible to move user to staged area. Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>	2015-05-22 15:41:41 +02:00
Martin Basti	fbdfd688b9	Server Upgrade: Fix uniqueness plugins ... Due previous changes (in master branch only) the uniqueness plugins became misconfigured. After this patch: * whole $SUFFIX will be checked by unique plugins * just staged users are exluded from check This reverts some changes in commit 52b7101c11 Since 389-ds-base 1.3.4.a1 new attribute 'uniqueness-exclude-subtrees' can be used. https://fedorahosted.org/freeipa/ticket/4921 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>	2015-05-19 12:45:41 +00:00
Martin Basti	5783d0c832	Server Upgrade: remove CSV from upgrade files ... CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>	2015-05-11 16:08:01 +00:00
Martin Basti	52b7101c11	Fix uniqueness plugins ... * add uniqueness-subtree-entries-oc:posixAccount to ensure idviews users will not be forced to have unique uid * remove unneded update plugins -> update was moved to .update file * add uniqueness-across-all-subtrees required by user lifecycle management Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>	2015-03-05 12:43:35 +01:00
Martin Basti	4b2ec5468f	Migrate uniquess plugins configuration to new style ... New configuration style contains options required for user lifecycle management. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>	2015-03-05 12:43:35 +01:00
Thierry bordaz (tbordaz)	04ea75a7a5	User Life Cycle: create containers and scoping DS plugins ... User Life Cycle is designed http://www.freeipa.org/page/V4/User_Life-Cycle_Management It manages 3 containers (Staging, Active, Delete). At install/upgrade Delete and Staging containers needs to be created. Active: cn=users,cn=accounts,$SUFFIX Delete: cn=deleted users,cn=accounts,cn=provisioning,$SUFFIX Stage: cn=staged users ,cn=accounts,cn=provisioning,$SUFFIX Plugins scopes: krbPrincipalName, krbCanonicalName, ipaUniqueID, uid: cn=accounts,SUFFIX cn=deleted users,cn=accounts,cn=provisioning,SUFFIX DNA: cn=accounts,SUFFIX Plugins exclude subtree: IPA UUID, Referential Integrity, memberOf: cn=provisioning,SUFFIX https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: Petr Viktorin <pviktori@redhat.com>	2014-08-19 09:48:20 +02:00
Jan Cholasta	fd80cc1c59	Configure attribute uniqueness for certificate store. ... Part of https://fedorahosted.org/freeipa/ticket/3259 Part of https://fedorahosted.org/freeipa/ticket/3520 Reviewed-By: Rob Crittenden <rcritten@redhat.com>	2014-07-30 16:04:21 +02:00
Rob Crittenden	96decfea26	Add uniqueness plugin configuration for sudorule cn ... We do a search looking for duplicate values but this leaves open the possibility that two adds are happening at the same time so both searches return NotFound therefore we get two entries with the same cn value. https://fedorahosted.org/freeipa/ticket/3017	2012-10-08 18:32:41 -04:00