freeipa

mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00

Files

Alexander Bokovoy 08d7209828 baseldap: allow rejecting unknown objects instead of adding to an external attr

IPA traditionally allowed to add names not found in IPA LDAP to external
attributes. This is used to allow, for example, a local system user or
group be present in a SUDO rule.

With membership validator, we can actually check validity of the names
against both IPA users/groups and users/groups from trusted domains.
If in future we decide to reject a local system's objects, then all it
would take is to switch reject_failures to True.

Fixes: https://pagure.io/freeipa/issue/3226
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>

2021-01-26 13:05:27 -05:00

advise

Change FreeIPA references to IPA and Identity Management

2021-01-21 13:51:45 +01:00

dnssec

Change mkdir logic in DNSSEC

2020-12-18 20:40:36 +02:00

install

Change FreeIPA references to IPA and Identity Management

2021-01-21 13:51:45 +01:00

plugins

baseldap: allow rejecting unknown objects instead of adding to an external attr