mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-28 01:41:14 -06:00
71f9008906
This will sync down the POSIX attributes from AD so we need to be careful to not mess with them when they are already set. This includes uidNumber, gidNumber, homeDirectory, loginShell and gecos. http://port389.org/wiki/WinSync_Posix http://port389.org/wiki/Windows_Sync_Plugin_API#Version_3_API_functions https://fedorahosted.org/freeipa/ticket/3007
50 lines
1.6 KiB
Plaintext
50 lines
1.6 KiB
Plaintext
# Enforce matching SSL certificate host names when 389-ds acts as an SSL
|
|
# client. A restart is necessary for this to take effect, we do one when
|
|
# upgrading.
|
|
dn: cn=config
|
|
only:nsslapd-ssl-check-hostname: on
|
|
|
|
# Remove incorrect placement
|
|
dn: cn=Kerberos Principal Name,cn=IPA MODRDN,cn=plugins,cn=config
|
|
remove: nsslapd-pluginPrecedence: 60
|
|
|
|
# Set the precedence of the ipa-modrdn plugin so it runs after other
|
|
# plugins (the default is 50).
|
|
dn: cn=IPA MODRDN,cn=plugins,cn=config
|
|
only: nsslapd-pluginPrecedence: 60
|
|
|
|
# Set limits to suite better IPA deployment sizes, defaults are too
|
|
# conservative
|
|
dn: cn=config
|
|
default: nsslapd-sizelimit:100000
|
|
|
|
dn: cn=config,cn=ldbm database,cn=plugins,cn=config
|
|
replace: nsslapd-lookthroughlimit:5000::100000
|
|
replace: nsslapd-idlistscanlimit:4000::100000
|
|
|
|
#Set much lower limits for anonymous searhes
|
|
dn: cn=anonymous-limits,cn=etc,$SUFFIX
|
|
default:objectclass:nsContainer
|
|
default:objectclass:top
|
|
default:cn: anonymous-limits
|
|
default:nsSizeLimit: 5000
|
|
default:nsLookThroughLimit: 5000
|
|
|
|
dn: cn=config
|
|
only:nsslapd-anonlimitsdn:'cn=anonymous-limits,cn=etc,$SUFFIX'
|
|
|
|
# Add a defaultNamingContext if one hasn't already been set. This was
|
|
# introduced in 389-ds-base-1.2.10-0.9.a8. Adding this to a server that
|
|
# doesn't support it generates a non-fatal error.
|
|
dn: cn=config
|
|
add:nsslapd-defaultNamingContext:'$SUFFIX'
|
|
|
|
# Allow the root DSE to be searched even with minssf set
|
|
dn: cn=config
|
|
only:nsslapd-minssf-exclude-rootdse:on
|
|
|
|
# Set the IPA winsync precedence so it will run after the DS
|
|
# POSIX winsync plugin
|
|
dn: cn=ipa-winsync,cn=plugins,cn=config
|
|
only: nsslapd-pluginPrecedence: 60
|