<html> <head> <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"> </head> <body bgcolor="#FFFFFF" text="#000000"> Hello, <blockquote>Thanks for all you feedbacks and help about which attributes to preserved and how to limit authentication (simple and krb) to Active accounts, here are my understandings: <ol> <li>Staging (container: cn=staged users,cn=accounts,cn=provisioning,SUFFIX) plugins scoping Staging: <ul> <li>ipa_pwd_extop (kerberos keys generated)</li> </ul> In order to prevent simple bind, there is pre-bind plugin or cos (nsAccoutLock: True). </li> <ul> <li>provisioning constraints - no constraint when creating an entry but to be activated the entries in that container must have:</li> <ul> <li> 'uid' RDN</li> <li>have OC: posixaccount, ipaObject (MUST: cn, uid, uidNumber, gidNumber, homedirectory, ipaUniqueID)</li> </ul> <li>ipa stageuser-add <login> It creates a stage entry with</li> </ul> </ol> <blockquote> <blockquote> <blockquote><tt>uidNumber: -1</tt> <tt>gidNumber: -1</tt> <tt>ipaUniqueID: autogenerate</tt> <tt>description: __no_upg__ manager: checks that the DN is an active user userPassword/krb keys: if userPassword is set, krb keys are generated </tt> </blockquote> </blockquote> </blockquote> <ol> <ul> <li>ipa stageuser-add <login> --from-delete It possibly updates (MOD-delete) the deleted entry to delete the attributes: <ul> <li>userPassword</li> <li>krb keys </li> </ul> </li> </ul> </ol> <blockquote> <blockquote>Then it moves (modrdn) the deleted entry to staging container where <blockquote><tt>uidNumber: <unchanged, so it is preserved from the prevous active account></tt> <tt>gidNumber: <unchanged</tt><tt><tt>, so it is preserved from the prevous active account</tt>></tt> <tt>ipaUniqueID: </tt><tt><unchanged</tt><tt><tt>, so it is preserved from the prevous active account</tt>></tt> <tt>description: __no_upg__ (to show there is not managed group) (Deleted entries have no userPassword nor krb keys) </tt></blockquote> </blockquote> </blockquote> <ol> <ul> <li>ipa stageuser-activate <login> To be activated an entry must have: <ul> <li>'uid' RDN</li> <li>have OC: posixaccount, ipaObject (MUST: cn, uid, uidNumber, gidNumber, homedirectory, ipaUniqueID)</li> </ul> It adds in the active container, a destination copy of a stage entry where <blockquote><tt>uidNumber: <unchanged> </tt><tt><tt><tt>(if it was '-1' DNA generates it) </tt></tt></tt> <tt>gidNumber: <unchanged</tt><tt>></tt> <tt><tt>(if it was '-1' DNA generates it) </tt></tt> <tt>ipaUniqueID: </tt><tt><unchanged</tt><tt><tt>> (if it was 'autogenerate' ipa uuid generates it) </tt></tt> <tt>description: value __no_upg__ is removed</tt> <tt>DN syntax attributes are cleared (but kept for schema checking) except: manager, managedby and secretary (those values must be active DN entries) userPassword/krb keys: copied from source entry if they exists </tt></blockquote> </li> </ul> </ol> <blockquote> <blockquote>Then removes the source entry from the 'Staging' container. </blockquote> </blockquote> <ol> <ul> <li>ipa stageuser-find <login></li> <li>ipa stageuser-show <login></li> <li>ipa stageuser-mod <login> <blockquote> DN syntax attributes: checks that the DN is an active user </blockquote> </li> <li>ipa stageuser-del <login> </li> </ul> </ol> <ol> <li>Active (container: cn=users,cn=accounts,SUFFIX) plugins scoping Staging: </li> </ol> <blockquote> <ul> <li>ipa_pwd_extop (kerberos keys generated)</li> <li>attribute uniqueness (ipaUniqueID, uid, krbprincipalname, krbcanonicalName)</li> <li>referential integrity</li> <li>memberof</li> <li>managed entries</li> <li>ipa uuid </li> </ul> In order to allow simple bind, there is pre-bind plugin or cos (nsAccoutLock: False). A new entry (user-add or stageuser-activate) is updated by DS plugins (UUID, memberof, managed entries, and DNA plugins) <ul> <li>ipa user-add <login></li> <li>ipa user-mod <login> DN syntax attributes: checks that the DN is an active user </li> <li>ipa user-show <login></li> <li>ipa user-find <login></li> <li>ipa user-delete <login> The entry is moved (modrdn) to Delete container: <ul> <li><tt>all memberships attributes updated by plugins (managed entries/memberof)</tt></li> <li><tt>group members updated by referential integrity </tt></li> </ul> then updated (mod) <ul> <li><tt>all DN syntax attributes are wiped except: manager, managedby, secretary</tt></li> <li><tt>description: add __no_upg__ value</tt></li> <li><tt>userPassword is deleted</tt></li> <li><tt>kerberos keys are </tt><tt>deleted</tt></li> </ul> </li> <li>ipa user-undelete <login> The entry is possibly updated (MOD-delete) to delete attributes <ul> <li>userPassword (no simple bind on undeleted entry, requires to create a password) </li> <li>kerberos keys (no kerberos bind on undeleted entry, requires to recreate user password)</li> </ul> Then is moved (modrdn) to Active container </li> </ul> </blockquote> <ol> <li>Delete (container is cn=deleted users,cn=accounts,SUFFIX) plugins scoping Delete: <blockquote> <ul> <li>ipa_pwd_extop (not required as Delete account should not have userPassword nor krb keys) </li> <li>attribute uniqueness (ipaUniqueID, uid, krbprincipalname, krbcanonicalName)</li> </ul> </blockquote> In order to prevent simple bind (in addition to userPassword being cleared), there is pre-bind plugin or cos (nsAccoutLock: True).</li> </ol> Thanks thierry </blockquote> </body> </html>