On 04/14/2014 12:55 PM, Martin Kosek wrote: [...] > dn: cn=masters,cn=ipa,cn=etc,SUFFIX > - ADD aci allowing reading hosts (to have it separate from global cn=etc one so > that we can once assign it only to ipamasters hostgroup for example) We don't have an ipamasters hostgroup. Should we? -- Petr³