mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-28 18:01:23 -06:00
6ea868e172
Merge the two identical sets of replication agreement permission ACIs for the domain and CA suffixes into a single set suitable for replication agreements for both suffixes. This makes the replication agreement permissions behave correctly during CA replica install, so that any non-admin user with the proper permissions (such as members of the ipaservers host group) can set up replication for the CA suffix. https://fedorahosted.org/freeipa/ticket/5399 Reviewed-By: Martin Basti <mbasti@redhat.com>
15 lines
523 B
Plaintext
15 lines
523 B
Plaintext
# add IPA CA managed suffix to master entry
|
|
dn: cn=$FQDN,cn=masters,cn=ipa,cn=etc,$SUFFIX
|
|
add: objectclass: ipaReplTopoManagedServer
|
|
add: ipaReplTopoManagedSuffix: o=ipaca
|
|
|
|
# add IPA CA topology configuration area
|
|
dn: cn=ca,cn=topology,cn=ipa,cn=etc,$SUFFIX
|
|
default: objectclass: top
|
|
default: objectclass: iparepltopoconf
|
|
default: ipaReplTopoConfRoot: o=ipaca
|
|
default: cn: ca
|
|
|
|
dn: cn=replica,cn=o\3Dipaca,cn=mapping tree,cn=config
|
|
onlyifexist: nsds5replicabinddngroup: cn=replication managers,cn=sysaccounts,cn=etc,$SUFFIX
|