IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-28 01:41:14 -06:00
Code Issues Packages Projects Releases Wiki Activity
356059e07d
freeipa/install/updates
History
Thierry bordaz (tbordaz) 04ea75a7a5 User Life Cycle: create containers and scoping DS plugins 
User Life Cycle is designed http://www.freeipa.org/page/V4/User_Life-Cycle_Management
It manages 3 containers (Staging, Active, Delete). At install/upgrade Delete and Staging
containers needs to be created.
		Active: cn=users,cn=accounts,$SUFFIX
		Delete: cn=deleted users,cn=accounts,cn=provisioning,$SUFFIX
		Stage:  cn=staged users ,cn=accounts,cn=provisioning,$SUFFIX

Plugins scopes:
		krbPrincipalName, krbCanonicalName, ipaUniqueID, uid:
			cn=accounts,SUFFIX
			cn=deleted users,cn=accounts,cn=provisioning,SUFFIX
		DNA:
			cn=accounts,SUFFIX

		Plugins exclude subtree:
		IPA UUID, Referential Integrity, memberOf:
			cn=provisioning,SUFFIX

https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-08-19 09:48:20 +02:00
..
10-config.update Allow hashed passwords in DS 2014-07-25 10:36:47 +02:00
10-enable-betxn.update Enable transactions by default, make password and modrdn TXN-aware 2012-11-21 14:55:12 +01:00
10-schema_compat.update sudorule: Enforce category ALL checks on dirsrv level 2014-06-25 20:14:51 +02:00
10-selinuxusermap.update Remove schema modifications from update files 2013-11-18 16:54:21 +01:00
10-uniqueness.update User Life Cycle: create containers and scoping DS plugins 2014-08-19 09:48:20 +02:00
19-managed-entries.update Move Managed Entries into their own container in the replicated space. 2011-09-12 16:28:27 -04:00
20-aci.update Allow read access to services in cn=masters to auth'd users 2014-07-04 15:58:14 +02:00
20-dna.update User Life Cycle: create containers and scoping DS plugins 2014-08-19 09:48:20 +02:00
20-host_nis_groups.update Move Managed Entries into their own container in the replicated space. 2011-09-12 16:28:27 -04:00
20-indices.update Add RADIUS proxy support to ipalib CLI 2013-12-03 14:49:10 +01:00
20-nss_ldap.update Name update files so they can be easily sorted. 2009-03-25 11:03:07 -04:00
20-replication.update Don't add another nsDS5ReplicaId on updates if one already exists 2013-02-06 12:22:00 +01:00
20-syncrepl.update User Life Cycle: create containers and scoping DS plugins 2014-08-19 09:48:20 +02:00
20-user_private_groups.update Add plugin framework to LDAP updates. 2011-11-22 23:57:10 -05:00
20-winsync_index.update Name update files so they can be easily sorted. 2009-03-25 11:03:07 -04:00
21-ca_renewal_container.update Use certmonger to renew CA subsystem certificates 2012-07-30 13:39:08 +02:00
21-certstore_container.update Add container for certificate store. 2014-07-30 16:04:21 +02:00
21-replicas_container.update Store list of non-master replicas in DIT and provide way to list them 2011-03-02 09:46:46 -05:00
25-referint.update Add RADIUS proxy support to ipalib CLI 2013-12-03 14:49:10 +01:00
30-policy.update Re-number some attributes to compress our usage to be contiguous 2010-05-27 10:50:49 -04:00
30-provisioning.update User Life Cycle: create containers and scoping DS plugins 2014-08-19 09:48:20 +02:00
30-s4u2proxy.update Add S4U2Proxy delegation permissions on upgrades 2012-02-15 18:00:46 +01:00
40-automember.update Enable automember for upgraded servers 2011-11-29 09:02:06 +01:00
40-delegation.update Add permissions for certificate store. 2014-07-30 16:04:21 +02:00
40-dns.update Fix: Missing ACI for records in 40-dns.update 2014-07-04 12:27:24 +02:00
40-otp.update Add support for managedBy to tokens 2014-06-16 10:13:59 +02:00
40-realm_domains.update Add list of domains associated to our realm to cn=etc 2013-02-19 14:15:46 +02:00
40-replication.update Extend ipa-replica-manage to be able to manage DNA ranges. 2013-03-13 10:32:36 -04:00
45-roles.update Convert Group default permissions to managed 2014-06-24 13:53:40 +02:00
50-7_bit_check.update Do not check userPassword with 7-bit plugin 2013-06-06 18:12:50 +02:00
50-dogtag10-migration.update Update Dogtag 9 database during replica installation 2014-03-14 14:26:38 +01:00
50-groupuuid.update The default groups we create should have ipaUniqueId set 2011-04-15 13:02:17 +02:00
50-hbacservice.update Add crond as a default HBAC service 2013-01-17 09:50:48 -05:00
50-ipaconfig.update Add support for managing user auth types 2013-11-08 12:48:15 +01:00
50-krbenctypes.update Add Camellia ciphers to allowed list. 2013-07-18 10:49:38 +03:00
50-lockout-policy.update Disallow direct modifications to enrolledBy. 2011-07-14 19:11:49 -04:00
50-nis.update - add a pair of ethers maps for computers with hardware addresses on file 2012-04-26 09:00:22 +02:00
55-pbacmemberof.update Enable transactions by default, make password and modrdn TXN-aware 2012-11-21 14:55:12 +01:00
60-trusts.update trusts: Make cn=adtrust agents sysaccount nestedgroup 2014-07-18 10:08:04 +02:00
61-trusts-s4u2proxy.update Add cifs principal to S4U2Proxy targets only when running ipa-adtrust-install 2012-10-09 18:15:01 -04:00
62-ranges.update Remove schema modifications from update files 2013-11-18 16:54:21 +01:00
Makefile.am User Life Cycle: create containers and scoping DS plugins 2014-08-19 09:48:20 +02:00
README Remove schema modifications from update files 2013-11-18 16:54:21 +01:00

README 

The update files are sorted before being processed because there are
cases where order matters (such as getting schema added first, creating
parent entries, etc).

Updates are applied in blocks of ten so that any entries that are dependant
on another can be added successfully without having to rely on the length
of the DN to get the sorting correct.

The file names should use the format #-<description>.update where # conforms
to this:

10 - 19: Configuration
20 - 29: 389-ds configuration, new indices
30 - 39: Structual elements of the DIT
40 - 49: Pre-loaded data
50 - 59: Cleanup existing data
60 - 69: AD Trust
70 - 79: Reserved
80 - 89: Reserved

These numbers aren't absolute, there may be reasons to put an update
into one place or another, but by adhereing to the scheme it will be
easier to find existing updates and know where to put new ones.