mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-30 10:47:08 -06:00
bc0c606885
Implement the caacl commands, which are used to indicate which principals may be issued certificates from which (sub-)CAs, using which profiles. At this commit, and until sub-CAs are implemented, all rules refer to the top-level CA (represented as ".") and no ca-ref argument is exposed. Also, during install and upgrade add a default CA ACL that permits certificate issuance for all hosts and services using the profile 'caIPAserviceCert' on the top-level CA. Part of: https://fedorahosted.org/freeipa/ticket/57 Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Martin Basti <mbasti@redhat.com>
12 lines
408 B
Plaintext
12 lines
408 B
Plaintext
# default CA ACL that grants use of caIPAserviceCert on top-level CA to all hosts and services
|
|
dn: ipauniqueid=autogenerate,cn=caacls,cn=ca,$SUFFIX
|
|
changetype: add
|
|
objectclass: ipaassociation
|
|
objectclass: ipacaacl
|
|
ipauniqueid: autogenerate
|
|
cn: hosts_services_caIPAserviceCert
|
|
ipaenabledflag: TRUE
|
|
ipamembercertprofile: cn=caIPAserviceCert,cn=certprofiles,cn=ca,$SUFFIX
|
|
hostcategory: all
|
|
servicecategory: all
|