mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-28 18:01:23 -06:00
85eb17553f
Defining schema-compat-ignore-subtree values for schema compat plugin config entries removes the default value (ignore: cn=tasks,cn=config). This default value prevented deadlocks. Schema plugin needs to scope the $SUFFIX and also any updates to its configuration. This change restrict the schema compat to those subtrees. It replaces the definition of ignored subtrees that would be too long for cn=config (tasks, mapping tree, replication, snmp..) https://fedorahosted.org/freeipa/ticket/4635 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
85 lines
6.4 KiB
Plaintext
85 lines
6.4 KiB
Plaintext
dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config
|
|
only:schema-compat-entry-rdn:'%ifeq("ipaEnabledFlag", "FALSE", "DISABLED", "cn=%{cn}")'
|
|
add:schema-compat-entry-attribute: 'sudoHost=%ifeq("hostCategory","all","ALL","%{hostMask}")'
|
|
add:schema-compat-entry-attribute: 'sudoRunAsUser=%%%{ipaSudoRunAsExtUserGroup}'
|
|
# Fix for #4324 (regression of #1309)
|
|
remove:schema-compat-entry-attribute:'sudoRunAsGroup=%deref("ipaSudoRunAs","cn")'
|
|
remove:schema-compat-entry-attribute:'sudoRunAsUser=%{ipaSudoRunAsExtUser}'
|
|
remove:schema-compat-entry-attribute:'sudoRunAsUser=%%%{ipaSudoRunAsExtUserGroup}'
|
|
remove:schema-compat-entry-attribute:'sudoRunAsUser=%deref("ipaSudoRunAs","uid")'
|
|
remove:schema-compat-entry-attribute:'sudoRunAsGroup=%{ipaSudoRunAsExtGroup}'
|
|
remove:schema-compat-entry-attribute:'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")'
|
|
|
|
# We need to add the value in a separate transaction
|
|
dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config
|
|
add: schema-compat-entry-attribute: 'sudoRunAsGroup=%deref_f("ipaSudoRunAsGroup","(objectclass=posixGroup)","cn")'
|
|
add: schema-compat-entry-attribute: 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%{ipaSudoRunAsExtUser}")'
|
|
add: schema-compat-entry-attribute: 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%%%{ipaSudoRunAsExtUserGroup}")'
|
|
add: schema-compat-entry-attribute: 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixAccount)\",\"uid\")")'
|
|
add: schema-compat-entry-attribute: 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")'
|
|
add: schema-compat-entry-attribute: 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\"ipaSudoRunAsGroup\",\"(objectclass=posixGroup)\",\"cn\")")'
|
|
remove: schema-compat-ignore-subtree: cn=changelog
|
|
remove: schema-compat-ignore-subtree: o=ipaca
|
|
add: schema-compat-restrict-subtree: '$SUFFIX'
|
|
add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config'
|
|
|
|
# Change padding for host and userCategory so the pad returns the same value
|
|
# as the original, '' or -.
|
|
dn: cn=ng,cn=Schema Compatibility,cn=plugins,cn=config
|
|
replace: schema-compat-entry-attribute:'nisNetgroupTriple=(%link("%ifeq(\"hostCategory\",\"all\",\"\",\"%collect(\\\"%{externalHost}\\\",\\\"%deref(\\\\\\\"memberHost\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberHost\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\")\")","-",",","%ifeq(\"userCategory\",\"all\",\"\",\"%collect(\\\"%deref(\\\\\\\"memberUser\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberUser\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\")\")","-"),%{nisDomainName:-})::nisNetgroupTriple=(%link("%ifeq(\"hostCategory\",\"all\",\"\",\"%collect(\\\"%{externalHost}\\\",\\\"%deref(\\\\\\\"memberHost\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberHost\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\")\")","%ifeq(\"hostCategory\",\"all\",\"\",\"-\")",",","%ifeq(\"userCategory\",\"all\",\"\",\"%collect(\\\"%deref(\\\\\\\"memberUser\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberUser\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\")\")","%ifeq(\"userCategory\",\"all\",\"\",\"-\")"),%{nisDomainName:-})'
|
|
remove: schema-compat-ignore-subtree: cn=changelog
|
|
remove: schema-compat-ignore-subtree: o=ipaca
|
|
add: schema-compat-restrict-subtree: '$SUFFIX'
|
|
add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config'
|
|
|
|
dn: cn=computers, cn=Schema Compatibility, cn=plugins, cn=config
|
|
default:objectClass: top
|
|
default:objectClass: extensibleObject
|
|
default:cn: computers
|
|
default:schema-compat-container-group: cn=compat, $SUFFIX
|
|
default:schema-compat-container-rdn: cn=computers
|
|
default:schema-compat-search-base: cn=computers, cn=accounts, $SUFFIX
|
|
default:schema-compat-search-filter: (&(macAddress=*)(fqdn=*)(objectClass=ipaHost))
|
|
default:schema-compat-entry-rdn: cn=%first("%{fqdn}")
|
|
default:schema-compat-entry-attribute: objectclass=device
|
|
default:schema-compat-entry-attribute: objectclass=ieee802Device
|
|
default:schema-compat-entry-attribute: cn=%{fqdn}
|
|
default:schema-compat-entry-attribute: macAddress=%{macAddress}
|
|
remove: schema-compat-ignore-subtree: cn=changelog
|
|
remove: schema-compat-ignore-subtree: o=ipaca
|
|
add: schema-compat-restrict-subtree: '$SUFFIX'
|
|
add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config'
|
|
|
|
dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config
|
|
add:schema-compat-entry-attribute: sudoOrder=%{sudoOrder}
|
|
|
|
dn: cn=users,cn=Schema Compatibility,cn=plugins,cn=config
|
|
remove: schema-compat-ignore-subtree: cn=changelog
|
|
remove: schema-compat-ignore-subtree: o=ipaca
|
|
add: schema-compat-restrict-subtree: '$SUFFIX'
|
|
add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config'
|
|
|
|
dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config
|
|
remove: schema-compat-ignore-subtree: cn=changelog
|
|
remove: schema-compat-ignore-subtree: o=ipaca
|
|
add: schema-compat-restrict-subtree: '$SUFFIX'
|
|
add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config'
|
|
|
|
dn: cn=Schema Compatibility,cn=plugins,cn=config
|
|
# We need to run schema-compat pre-bind callback before
|
|
# other IPA pre-bind callbacks to make sure bind DN is
|
|
# rewritten to the original entry if needed
|
|
add:nsslapd-pluginprecedence: 49
|
|
|
|
dn: cn=users,cn=Schema Compatibility,cn=plugins,cn=config
|
|
add:schema-compat-entry-attribute: '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")'
|
|
add:schema-compat-entry-attribute: '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:$DOMAIN:%{ipauniqueid}","")'
|
|
add:schema-compat-entry-attribute: 'ipaanchoruuid=%{ipaanchoruuid}'
|
|
add:schema-compat-entry-attribute: '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")'
|
|
|
|
dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config
|
|
add:schema-compat-entry-attribute: '%ifeq("ipauniqueid","%{ipauniqueid}","objectclass=ipaOverrideTarget","")'
|
|
add:schema-compat-entry-attribute: '%ifeq("ipauniqueid","%{ipauniqueid}","ipaanchoruuid=:IPA:$DOMAIN:%{ipauniqueid}","")'
|
|
add:schema-compat-entry-attribute: 'ipaanchoruuid=%{ipaanchoruuid}'
|
|
add:schema-compat-entry-attribute: '%ifeq("ipaanchoruuid","%{ipaanchoruuid}","objectclass=ipaOverrideTarget","")'
|