Thierry bordaz (tbordaz)
d1691eee88
Add a accounts plugin (accounts class) that defines variables and methods common to 'users' and 'stageuser'. accounts is a superclass of users/stageuser Add the stageuser plugin, with support of stageuser-add verb. Reviewed By: David Kupka, Martin Basti, Jan Cholasta https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
27 lines
962 B
Plaintext
27 lines
962 B
Plaintext
# bootstrap the user life cycle DIT structure.
|
|
|
|
dn: cn=provisioning,$SUFFIX
|
|
default: objectclass: top
|
|
default: objectclass: nsContainer
|
|
default: cn: provisioning
|
|
|
|
dn: cn=accounts,cn=provisioning,$SUFFIX
|
|
default: objectclass: top
|
|
default: objectclass: nsContainer
|
|
default: cn: accounts
|
|
|
|
dn: cn=staged users,cn=accounts,cn=provisioning,$SUFFIX
|
|
default: objectclass: top
|
|
default: objectclass: nsContainer
|
|
default: cn: staged users
|
|
|
|
dn: cn=deleted users,cn=accounts,cn=provisioning,$SUFFIX
|
|
default: objectclass: top
|
|
default: objectclass: nsContainer
|
|
default: cn: staged users
|
|
|
|
# This is used for the admin to know if credential are set for stage users
|
|
# We can do a query on a DN to see if an attribute exists.
|
|
dn: cn=staged users,cn=accounts,cn=provisioning,$SUFFIX
|
|
add:aci: '(targetattr="userPassword || krbPrincipalKey")(version 3.0; acl "Search existence of password and kerberos keys"; allow(search) userdn = "ldap:///uid=admin,cn=users,cn=accounts,$SUFFIX";)'
|