<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 28/05/15 12:53, Christian Heimes
wrote:<br>
</div>
<blockquote cite="mid:5566F3B6.7020303@redhat.com" type="cite">
<pre wrap="">On 2015-05-28 12:46, Martin Kosek wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I am fine with this too. So if there is not another major disagreement, let us
start with enabling KDCPROXY by default during upgrade/install, the new ACI and
the per-replica standard configuration.
API CLI/UI can come later (4.2.x or 4.3).
</pre>
</blockquote>
<pre wrap="">
LGTM, too.
How should the new ACI work? I see two possible ways:
1) Allow compare/search for ipaConfigString=enabledService for everybody:
(targetfilter="(ipaConfigString=enabledService)")(targetattr="ipaConfigString")(version
3.0; acl "Compare enabledService access to masters"; allow(search,
compare) userdn = <a class="moz-txt-link-rfc2396E" href="ldap:///all">"ldap:///all"</a>;)
2) Create a new permission, assign it to all HTTP principals and allow
read, compare and search for all ipaConfigString attributes.
For the second way I need somebody to walk me through the permission and
role system of FreeIPA.</pre>
</blockquote>
3) Or we can create a new keytab for KDC proxy, and add permission
only for this service<br>
<br>
<blockquote cite="mid:5566F3B6.7020303@redhat.com" type="cite">
<pre wrap="">
Christian
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Martin Basti</pre>
</body>
</html>