mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-23 07:33:27 -06:00
468eb3c712
User with the 'Enrollment Administrator' role assigned is able to enroll client with ipa-client-install command. Resolves: https://pagure.io/freeipa/issue/6852 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
103 lines
3.8 KiB
Plaintext
103 lines
3.8 KiB
Plaintext
# Helpdesk roles
|
|
dn: cn=Modify Users and Reset passwords,cn=privileges,cn=pbac,$SUFFIX
|
|
default:objectClass: top
|
|
default:objectClass: groupofnames
|
|
default:objectClass: nestedgroup
|
|
default:cn: Modify Users and Reset passwords
|
|
default:description: Modify Users and Reset passwords
|
|
default:member: cn=helpdesk,cn=roles,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=Modify Group membership,cn=privileges,cn=pbac,$SUFFIX
|
|
default:objectClass: top
|
|
default:objectClass: groupofnames
|
|
default:objectClass: nestedgroup
|
|
default:cn: Modify Group membership
|
|
default:description: Modify Group membership
|
|
default:member: cn=helpdesk,cn=roles,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=User Administrator,cn=roles,cn=accounts,$SUFFIX
|
|
default:objectClass: groupofnames
|
|
default:objectClass: nestedgroup
|
|
default:objectClass: top
|
|
default:cn: User Administrator
|
|
default:description: Responsible for creating Users and Groups
|
|
|
|
dn: cn=User Administrators,cn=privileges,cn=pbac,$SUFFIX
|
|
add: member: cn=User Administrator,cn=roles,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=Group Administrators,cn=privileges,cn=pbac,$SUFFIX
|
|
add: member: cn=User Administrator,cn=roles,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=Stage User Administrators,cn=privileges,cn=pbac,$SUFFIX
|
|
default:objectClass: groupofnames
|
|
default:objectClass: nestedgroup
|
|
default:objectClass: top
|
|
default:cn: Stage User Administrators
|
|
default:description: Stage User Administrators
|
|
add: member: cn=User Administrator,cn=roles,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX
|
|
default:objectClass: groupofnames
|
|
default:objectClass: nestedgroup
|
|
default:objectClass: top
|
|
default:cn: IT Specialist
|
|
default:description: IT Specialist
|
|
|
|
dn: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX
|
|
add:member: cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=Host Group Administrators,cn=privileges,cn=pbac,$SUFFIX
|
|
add:member: cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=Service Administrators,cn=privileges,cn=pbac,$SUFFIX
|
|
add:member: cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=Automount Administrators,cn=privileges,cn=pbac,$SUFFIX
|
|
add:member: cn=IT Specialist,cn=roles,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=IT Security Specialist,cn=roles,cn=accounts,$SUFFIX
|
|
default:objectClass: groupofnames
|
|
default:objectClass: nestedgroup
|
|
default:objectClass: top
|
|
default:cn: IT Security Specialist
|
|
default:description: IT Security Specialist
|
|
|
|
dn: cn=Netgroups Administrators,cn=privileges,cn=pbac,$SUFFIX
|
|
add:member: cn=IT Security Specialist,cn=roles,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=HBAC Administrator,cn=privileges,cn=pbac,$SUFFIX
|
|
add:member: cn=IT Security Specialist,cn=roles,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=Sudo administrator,cn=privileges,cn=pbac,$SUFFIX
|
|
add:member: cn=IT Security Specialist,cn=roles,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=Security Architect,cn=roles,cn=accounts,$SUFFIX
|
|
default:objectClass: groupofnames
|
|
default:objectClass: nestedgroup
|
|
default:objectClass: top
|
|
default:cn: Security Architect
|
|
default:description: Security Architect
|
|
|
|
dn: cn=Delegation Administrator,cn=privileges,cn=pbac,$SUFFIX
|
|
add:member: cn=Security Architect,cn=roles,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=Replication Administrators,cn=privileges,cn=pbac,$SUFFIX
|
|
add:member: cn=ipaservers,cn=hostgroups,cn=accounts,$SUFFIX
|
|
add:member: cn=Security Architect,cn=roles,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=Write IPA Configuration,cn=privileges,cn=pbac,$SUFFIX
|
|
add:member: cn=Security Architect,cn=roles,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=Password Policy Administrator,cn=privileges,cn=pbac,$SUFFIX
|
|
add:member: cn=Security Architect,cn=roles,cn=accounts,$SUFFIX
|
|
|
|
dn: cn=Enrollment Administrator,cn=roles,cn=accounts,$SUFFIX
|
|
default:objectClass: groupofnames
|
|
default:objectClass: nestedgroup
|
|
default:objectClass: top
|
|
default:cn: Enrollment Administrator
|
|
default:description: Enrollment Administrator responsible for client(host) enrollment
|
|
|
|
dn: cn=Host Enrollment,cn=privileges,cn=pbac,$SUFFIX
|
|
add:member: cn=Enrollment Administrator,cn=roles,cn=accounts,$SUFFIX
|