<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 01/14/2015 10:15 AM, Petr Viktorin
wrote:<br>
</div>
<blockquote cite="mid:54B633A5.2020904@redhat.com" type="cite">On
01/13/2015 10:52 PM, Martin Kosek wrote:
<br>
<blockquote type="cite">On 01/13/2015 09:55 PM, Simo Sorce wrote:
<br>
<blockquote type="cite">On Tue, 13 Jan 2015 18:16:11 +0100
<br>
Martin Kosek <a class="moz-txt-link-rfc2396E" href="mailto:mkosek@redhat.com"><mkosek@redhat.com></a> wrote:
<br>
<br>
<blockquote type="cite">This is crude first version of the
(working) fixes to fix
<br>
Winsync/Passsync problems caused by the PermissionV2
refactoring.
<br>
<br>
Simo/Petr3 or others, any concerns?
<br>
<br>
</blockquote>
<br>
The first patch looks good
<br>
the second looks .. broad ?
<br>
<br>
Shouldn't you explicitly allow specific attributes ?
<br>
</blockquote>
<br>
You mean for:
<br>
<br>
+ 'System: Read LDBM database config': {
<br>
+ 'ipapermlocation': DN('cn=config'),
<br>
+ 'ipapermtarget': DN('cn=config,cn=ldbm
<br>
database,cn=plugins,cn=config'),
<br>
+ 'ipapermbindruletype': 'permission',
<br>
+ 'ipapermright': {'read', 'search', 'compare'},
<br>
+ 'default_privileges': {'Replication Administrators'},
<br>
+ 'ipapermdefaultattr': {'*'},
<br>
+ },
<br>
<br>
? I did that as my first try, but then the ACI was not accepted
as the
<br>
attribute I was looking for (nsslapd-changelogdir) is not in the
schema
<br>
as the config is just an extensibleObject. But as I was going
through
<br>
the attributes, I did not see anything super-secret.
<br>
<br>
Petr, is there any way to make permission plugin accept unknown
<br>
attribute in the permission attribute list, or do we need to use
"*" in
<br>
this case?
<br>
</blockquote>
<br>
The ACL Syntax Error comes straight from the DS, so there's not
much IPA can do. The error suggests adding nsslapd-changelogdir to
the schema, but I'm not sure that's the right solution here.
<br>
Thierry, any comments? See the attached LDIF.
<br>
<br>
</blockquote>
<font face="Times New Roman, Times, serif">Actually this limitation
was added with the bug
<a class="moz-txt-link-freetext" href="https://bugzilla.redhat.com/show_bug.cgi?id=244229">https://bugzilla.redhat.com/show_bug.cgi?id=244229</a>.<br>
I do not see in the bug, if the ability to define non schema
attribute was creating a problem for IPA<br>
<br>
thanks<br>
thierry<br>
</font>
</body>
</html>