mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-28 01:41:14 -06:00
d4a0fa34af
- add missing closing parenthesis in idnsRecord declaration - remove extra dollar sign from ipaSudoRule declaration - handle missing/extraneous X-ORIGIN lines in 10-selinuxusermap.update This does not use the schema updater because the syntax needs to be fixed in the files themselves, otherwise 389 1.3.2+ will fail to start. Older DS versions transparently fix the syntax errors. The existing ldap-updater directive for ipaSudoRule is fixed (ldap-updater runs after upgradeconfig). https://fedorahosted.org/freeipa/ticket/3578
84 lines
4.6 KiB
Plaintext
84 lines
4.6 KiB
Plaintext
#
|
|
# New schema enhancements from:
|
|
# https://fedorahosted.org/bind-dyndb-ldap/browser/doc/schema
|
|
#
|
|
dn: cn=schema
|
|
add:attributeTypes:
|
|
( 2.16.840.1.113730.3.8.5.11
|
|
NAME 'idnsAllowQuery'
|
|
DESC 'BIND9 allow-query ACL element'
|
|
EQUALITY caseIgnoreIA5Match
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
|
|
SINGLE-VALUE
|
|
X-ORIGIN 'IPA v2')
|
|
add:attributeTypes:
|
|
( 2.16.840.1.113730.3.8.5.12
|
|
NAME 'idnsAllowTransfer'
|
|
DESC 'BIND9 allow-transfer ACL element'
|
|
EQUALITY caseIgnoreIA5Match
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
|
|
SINGLE-VALUE
|
|
X-ORIGIN 'IPA v2')
|
|
add:attributeTypes:
|
|
( 2.16.840.1.113730.3.8.5.13
|
|
NAME 'idnsAllowSyncPTR'
|
|
DESC 'permit synchronization of PTR records'
|
|
EQUALITY booleanMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
|
|
SINGLE-VALUE
|
|
X-ORIGIN 'IPA v2' )
|
|
add:attributeTypes:
|
|
( 2.16.840.1.113730.3.8.5.14
|
|
NAME 'idnsForwardPolicy'
|
|
DESC 'forward policy: only or first'
|
|
EQUALITY caseIgnoreIA5Match
|
|
SUBSTR caseIgnoreIA5SubstringsMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
|
|
SINGLE-VALUE
|
|
X-ORIGIN 'IPA v2' )
|
|
add:attributeTypes:
|
|
( 2.16.840.1.113730.3.8.5.15
|
|
NAME 'idnsForwarders'
|
|
DESC 'list of forwarders'
|
|
EQUALITY caseIgnoreIA5Match
|
|
SUBSTR caseIgnoreIA5SubstringsMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
|
|
X-ORIGIN 'IPA v2' )
|
|
add:attributeTypes:
|
|
( 2.16.840.1.113730.3.8.5.16
|
|
NAME 'idnsZoneRefresh'
|
|
DESC 'zone refresh interval'
|
|
EQUALITY integerMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
|
|
SINGLE-VALUE
|
|
X-ORIGIN 'IPA v2' )
|
|
add:attributeTypes:
|
|
( 2.16.840.1.113730.3.8.5.17
|
|
NAME 'idnsPersistentSearch'
|
|
DESC 'allow persistent searches'
|
|
EQUALITY booleanMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
|
|
SINGLE-VALUE
|
|
X-ORIGIN 'IPA v2' )
|
|
add:objectClasses:
|
|
( 2.16.840.1.113730.3.8.6.2
|
|
NAME 'idnsConfigObject'
|
|
DESC 'DNS global config options'
|
|
STRUCTURAL
|
|
MAY ( idnsForwardPolicy $$ idnsForwarders $$ idnsAllowSyncPTR $$
|
|
idnsZoneRefresh $$ idnsPersistentSearch
|
|
) )
|
|
add:objectClasses:
|
|
( 2.16.840.1.113730.3.8.12.18
|
|
NAME 'ipaDNSZone'
|
|
SUP top AUXILIARY
|
|
MUST idnsName
|
|
MAY managedBy
|
|
X-ORIGIN 'IPA v3' )
|
|
|
|
dn: cn=schema
|
|
replace:objectClasses:( 2.16.840.1.113730.3.8.6.1 NAME 'idnsZone' DESC 'Zone class' SUP idnsRecord STRUCTURAL MUST ( idnsZoneActive $$ idnsSOAmName $$ idnsSOArName $$ idnsSOAserial $$ idnsSOArefresh $$ idnsSOAretry $$ idnsSOAexpire $$ idnsSOAminimum ) MAY idnsUpdatePolicy )::( 2.16.840.1.113730.3.8.6.1 NAME 'idnsZone' DESC 'Zone class' SUP idnsRecord STRUCTURAL MUST ( idnsName $$ idnsZoneActive $$ idnsSOAmName $$ idnsSOArName $$ idnsSOAserial $$ idnsSOArefresh $$ idnsSOAretry $$ idnsSOAexpire $$ idnsSOAminimum ) MAY ( idnsUpdatePolicy $$ idnsAllowQuery $$ idnsAllowTransfer $$ idnsAllowSyncPTR $$ idnsForwardPolicy $$ idnsForwarders ) )
|
|
replace:attributeTypes:"(1.3.6.1.4.1.2428.20.1.39 NAME 'dNameRecord' DESC 'Non-Terminal DNS Name Redirection, RFC 2672' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26)::( 1.3.6.1.4.1.2428.20.1.39 NAME 'dNameRecord' DESC 'Non-Terminal DNS Name Redirection, RFC 2672' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )"
|
|
replace:attributeTypes: (0.9.2342.19200300.100.1.31 NAME 'cNAMERecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26)::( 0.9.2342.19200300.100.1.31 NAME 'cNAMERecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
|
replace:objectClasses:"( 2.16.840.1.113730.3.8.6.0 NAME 'idnsRecord' DESC 'dns Record, usually a host' SUP top STRUCTURAL MUST idnsName MAY ( cn $$ idnsAllowDynUpdate $$ DNSTTL $$ DNSClass $$ ARecord $$ AAAARecord $$ A6Record $$ NSRecord $$ CNAMERecord $$ PTRRecord $$ SRVRecord $$ TXTRecord $$ MXRecord $$ MDRecord $$ HINFORecord $$ MINFORecord $$ AFSDBRecord $$ SIGRecord $$ KEYRecord $$ LOCRecord $$ NXTRecord $$ NAPTRRecord $$ KXRecord $$ CERTRecord $$ DNAMERecord $$ DSRecord $$ SSHFPRecord $$ RRSIGRecord $$ NSECRecord ) )::( 2.16.840.1.113730.3.8.6.0 NAME 'idnsRecord' DESC 'dns Record, usually a host' SUP top STRUCTURAL MUST idnsName MAY ( idnsAllowDynUpdate $$ DNSTTL $$ DNSClass $$ ARecord $$ AAAARecord $$ A6Record $$ NSRecord $$ CNAMERecord $$ PTRRecord $$ SRVRecord $$ TXTRecord $$ MXRecord $$ MDRecord $$ HINFORecord $$ MINFORecord $$ AFSDBRecord $$ SIGRecord $$ KEYRecord $$ LOCRecord $$ NXTRecord $$ NAPTRRecord $$ KXRecord $$ CERTRecord $$ DNAMERecord $$ DSRecord $$ SSHFPRecord $$ RRSIGRecord $$ NSECRecord ) )"
|