|
 |
95ea96 |
From 34d06b2be71823bc8898732f1ced0185f83afb01 Mon Sep 17 00:00:00 2001
|
|
|
95ea96 |
From: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
95ea96 |
Date: Wed, 28 Mar 2018 12:39:12 +0300
|
|
|
95ea96 |
Subject: [PATCH] Allow anonymous access to parentID attribute
|
|
|
95ea96 |
|
|
|
95ea96 |
Due to optimizations in 389-ds performed as result of
|
|
|
95ea96 |
https://pagure.io/389-ds-base/issue/49372, LDAP search filter
|
|
|
95ea96 |
is rewritten to include parentID information. It implies that parentID
|
|
|
95ea96 |
has to be readable for a bound identity performing the search. This is
|
|
|
95ea96 |
what 389-ds expects right now but FreeIPA DS instance does not allow it.
|
|
|
95ea96 |
|
|
|
95ea96 |
As result, searches with a one-level scope fail to return results that
|
|
|
95ea96 |
otherwise are matched in a sub scope search.
|
|
|
95ea96 |
|
|
|
95ea96 |
While 389-ds developers are working on the fix for issue
|
|
|
95ea96 |
https://pagure.io/389-ds-base/issue/49617, we can fix it by adding an
|
|
|
95ea96 |
explicit ACI to allow reading parentID attribute at the suffix level.
|
|
|
95ea96 |
|
|
|
95ea96 |
Fixes: https://pagure.io/freeipa/issue/7466
|
|
|
95ea96 |
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
95ea96 |
Reviewed-By: Christian Heimes <cheimes@redhat.com>
|
|
|
95ea96 |
---
|
|
|
95ea96 |
install/updates/20-aci.update | 4 ++++
|
|
|
95ea96 |
1 file changed, 4 insertions(+)
|
|
|
95ea96 |
|
|
|
95ea96 |
diff --git a/install/updates/20-aci.update b/install/updates/20-aci.update
|
|
|
95ea96 |
index dec2e16ee..b8a172eb5 100644
|
|
|
95ea96 |
--- a/install/updates/20-aci.update
|
|
|
95ea96 |
+++ b/install/updates/20-aci.update
|
|
|
95ea96 |
@@ -21,6 +21,10 @@ add:aci:(targetattr="ipasshpubkey")(version 3.0; acl "Hosts can manage other hos
|
|
|
95ea96 |
dn: $SUFFIX
|
|
|
95ea96 |
add:aci:(targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)
|
|
|
95ea96 |
|
|
|
95ea96 |
+# Read access to parentID information to allow filter optimizations in 389-ds
|
|
|
95ea96 |
+dn: $SUFFIX
|
|
|
95ea96 |
+add:aci:(targetattr="parentid")(version 3.0; acl "Anonymous read access to parentID information"; allow(read, search, compare) userdn = "ldap:///anyone";)
|
|
|
95ea96 |
+
|
|
|
95ea96 |
# Read access to containers
|
|
|
95ea96 |
dn: $SUFFIX
|
|
|
95ea96 |
add:aci:(targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,$SUFFIX")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)
|
|
|
95ea96 |
--
|
|
|
95ea96 |
2.17.1
|
|
|
95ea96 |
|