mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-01-12 17:21:55 -06:00
1207a7c83f
The change_password permission was too broad, limit it to users. The DNS access controls rolled everything into a single ACI. I broke it out into separate ACIs for add, delete and add. I also added a new dns type for the permission plugin. ticket 628
56 lines
2.4 KiB
Plaintext
56 lines
2.4 KiB
Plaintext
dn: cn=dns,$SUFFIX
|
|
changetype: add
|
|
objectClass: nsContainer
|
|
objectClass: top
|
|
cn: dns
|
|
|
|
dn: cn=add dns entries,cn=permissions,cn=accounts,$SUFFIX
|
|
changetype: add
|
|
objectClass: groupofnames
|
|
objectClass: top
|
|
cn: add dns entries
|
|
description: Add DNS entries
|
|
member: cn=dnsadmin,cn=privileges,cn=accounts,$SUFFIX
|
|
member: cn=dnsserver,cn=privileges,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=remove dns entries,cn=permissions,cn=accounts,$SUFFIX
|
|
changetype: add
|
|
objectClass: groupofnames
|
|
objectClass: top
|
|
cn: remove dns entries
|
|
description: Remove DNS entries
|
|
member: cn=dnsadmin,cn=privileges,cn=accounts,$SUFFIX
|
|
member: cn=dnsserver,cn=privileges,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=update dns entries,cn=permissions,cn=accounts,$SUFFIX
|
|
changetype: add
|
|
objectClass: groupofnames
|
|
objectClass: top
|
|
cn: update dns entries
|
|
description: Update DNS entries
|
|
member: cn=dnsadmin,cn=privileges,cn=accounts,$SUFFIX
|
|
member: cn=dnsserver,cn=privileges,cn=accounts,$SUFFIX
|
|
|
|
dn: $SUFFIX
|
|
changetype: modify
|
|
add: aci
|
|
aci: (target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "Add DNS entries";allow (add) groupdn = "ldap:///cn=add dns entries,cn=permissions,cn=accounts,$SUFFIX";)
|
|
aci: (target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "Remove DNS entries";allow (delete) groupdn = "ldap:///cn=remove dns entries,cn=permissions,cn=accounts,$SUFFIX";)
|
|
aci: (targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy")(target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "Update DNS entries";allow (write) groupdn = "ldap:///cn=update dns entries,cn=permissions,cn=accounts,$SUFFIX";)
|
|
|
|
dn: cn=dnsadmin,cn=privileges,cn=accounts,$SUFFIX
|
|
changetype: add
|
|
objectClass: top
|
|
objectClass: groupofnames
|
|
objectClass: nestedgroup
|
|
cn: dnsadmin
|
|
description: DNS Administrators
|
|
|
|
dn: cn=dnsserver,cn=privileges,cn=accounts,$SUFFIX
|
|
changetype: add
|
|
objectClass: top
|
|
objectClass: groupofnames
|
|
objectClass: nestedgroup
|
|
cn: dnsserver
|
|
description: DNS Servers
|