freeipa/install
Alexander Bokovoy 120bab0d9c trust: allow trust agents to read POSIX identities of trust
SSSD and Samba on IPA masters need to be able to look up POSIX
attributes of trusted domain objects in order to allow Active Directory
domain controllers from trusted forests to connect to LSA and NETLOGON
pipes.

We only have access to read POSIX attributes in cn=accounts,$SUFFIX
subtree rather than whole $SUFFIX. Thus, add an ACI to trusts subtree.

Fixes: https://pagure.io/freeipa/issue/6077
Reviewed-By: Christian Heimes <cheimes@redhat.com>
2019-03-28 14:08:19 +01:00
..
certmonger Generate scripts from templates 2018-08-23 14:49:06 +02:00
html Fix javascript 'errors' found by jslint 2018-09-27 16:33:25 +02:00
migration Use new LDAPClient constructors 2019-02-05 08:39:13 -05:00
oddjob Generate scripts from templates 2018-08-23 14:49:06 +02:00
restart_scripts Generate scripts from templates 2018-08-23 14:49:06 +02:00
share Let 389-DS configure LDAPI for us 2019-02-05 08:39:13 -05:00
tools ipa-replica-manage: fix force-sync 2019-03-25 09:46:36 +01:00
ui Web UI (topology graph): Show FQDN for nodes if they have no common DNS zone 2019-03-21 16:01:11 +01:00
updates trust: allow trust agents to read POSIX identities of trust 2019-03-28 14:08:19 +01:00
wsgi Add absolute_import future imports 2018-04-20 09:43:37 +02:00
Makefile.am Encrypt httpd key stored on disk 2018-03-23 12:48:46 +01:00
README.schema Add some basic rules for adding new schema 2010-08-27 13:40:37 -04:00

Ground rules on adding new schema

Brand new schema, particularly when written specifically for IPA, should be
added in share/*.ldif. Any new files need to be explicitly loaded in
ipaserver/install/dsinstance.py. These simply get copied directly into
the new instance schema directory.

Existing schema (e.g. in an LDAP draft) may either be added as a separate
ldif in share or as an update in the updates directory. The advantage of
adding the schema as an update is if 389-ds ever adds the schema then the
installation won't fail due to existing schema failing to load during
bootstrap.

If the new schema requires a new container then this should be added
to install/bootstrap-template.ldif.