# add IPA CA managed suffix to master entry dn: cn=$FQDN,cn=masters,cn=ipa,cn=etc,$SUFFIX add: objectclass: ipaReplTopoManagedServer add: ipaReplTopoManagedSuffix: o=ipaca # add IPA CA topology configuration area dn: cn=ipaca,cn=topology,cn=ipa,cn=etc,$SUFFIX default: objectclass: top default: objectclass: iparepltopoconf default: ipaReplTopoConfRoot: o=ipaca default: cn: ipaca # Update CA replication settings dn: cn=o\3Dipaca,cn=mapping tree,cn=config add: aci: (targetattr=*)(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,$SUFFIX";) add: aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,$SUFFIX";) add: aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,$SUFFIX";) dn: cn=replica,cn=o\3Dipaca,cn=mapping tree,cn=config onlyifexist: nsds5replicabinddngroup: cn=replication managers,cn=sysaccounts,cn=etc,$SUFFIX