|
 |
86baa9 |
From 4145fbdb5428b11274344cfc97eb2fe5ba9537a5 Mon Sep 17 00:00:00 2001
|
|
|
86baa9 |
From: Fraser Tweedale <ftweedal@redhat.com>
|
|
|
86baa9 |
Date: Thu, 7 Dec 2017 12:52:54 +1100
|
|
|
86baa9 |
Subject: [PATCH] Add uniqueness constraint on CA ACL name
|
|
|
86baa9 |
|
|
|
86baa9 |
It is possible to add caacl entries with same "name" (cn). The
|
|
|
86baa9 |
command is supposed to prevent this but direct LDAP operations allow
|
|
|
86baa9 |
it and doing that will cause subsequent errors.
|
|
|
86baa9 |
|
|
|
86baa9 |
Enable the DS uniqueness constraint plugin for the cn attribute in
|
|
|
86baa9 |
CA ACL entries.
|
|
|
86baa9 |
|
|
|
86baa9 |
Fixes: https://pagure.io/freeipa/issue/7304
|
|
|
86baa9 |
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
86baa9 |
Reviewed-By: Christian Heimes <cheimes@redhat.com>
|
|
|
86baa9 |
---
|
|
|
86baa9 |
install/updates/10-uniqueness.update | 17 +++++++++++++++++
|
|
|
86baa9 |
1 file changed, 17 insertions(+)
|
|
|
86baa9 |
|
|
|
86baa9 |
diff --git a/install/updates/10-uniqueness.update b/install/updates/10-uniqueness.update
|
|
|
86baa9 |
index 050bfd55ec2e6a09c44700ae40757ee1d72c136f..77facba195cb5a1564818010f97afdd15d65a274 100644
|
|
|
86baa9 |
--- a/install/updates/10-uniqueness.update
|
|
|
86baa9 |
+++ b/install/updates/10-uniqueness.update
|
|
|
86baa9 |
@@ -92,3 +92,20 @@ add:uniqueness-across-all-subtrees: on
|
|
|
86baa9 |
dn: cn=ipaUniqueID uniqueness,cn=plugins,cn=config
|
|
|
86baa9 |
add:uniqueness-exclude-subtrees: cn=staged users,cn=accounts,cn=provisioning,$SUFFIX
|
|
|
86baa9 |
add:uniqueness-across-all-subtrees: on
|
|
|
86baa9 |
+
|
|
|
86baa9 |
+dn: cn=caacl name uniqueness,cn=plugins,cn=config
|
|
|
86baa9 |
+default:objectClass: top
|
|
|
86baa9 |
+default:objectClass: nsSlapdPlugin
|
|
|
86baa9 |
+default:objectClass: extensibleObject
|
|
|
86baa9 |
+default:cn: caacl name uniqueness
|
|
|
86baa9 |
+default:nsslapd-pluginDescription: Enforce unique attribute values
|
|
|
86baa9 |
+default:nsslapd-pluginPath: libattr-unique-plugin
|
|
|
86baa9 |
+default:nsslapd-pluginInitfunc: NSUniqueAttr_Init
|
|
|
86baa9 |
+default:nsslapd-pluginType: preoperation
|
|
|
86baa9 |
+default:nsslapd-pluginEnabled: on
|
|
|
86baa9 |
+default:uniqueness-attribute-name: cn
|
|
|
86baa9 |
+default:uniqueness-subtrees: cn=caacls,cn=ca,$SUFFIX
|
|
|
86baa9 |
+default:nsslapd-plugin-depends-on-type: database
|
|
|
86baa9 |
+default:nsslapd-pluginId: NSUniqueAttr
|
|
|
86baa9 |
+default:nsslapd-pluginVersion: 1.1.0
|
|
|
86baa9 |
+default:nsslapd-pluginVendor: Fedora Project
|
|
|
86baa9 |
--
|
|
|
86baa9 |
2.20.1
|
|
|
86baa9 |
|