aboutsummaryrefslogtreecommitdiffstats
path: root/modules/openldap
diff options
context:
space:
mode:
authorMichael Scherer <misc@mageia.org>2010-12-16 12:49:49 +0000
committerMichael Scherer <misc@mageia.org>2010-12-16 12:49:49 +0000
commit8d0ca9f823da75722bc542725c4753d7168bbd21 (patch)
treed3ff41e55afac6f35ee3f974d9d95fa47bd4349e /modules/openldap
parent1aaefdac5b416e38ce35f7345cf74f9a3effd2b7 (diff)
downloadpuppet-8d0ca9f823da75722bc542725c4753d7168bbd21.tar
puppet-8d0ca9f823da75722bc542725c4753d7168bbd21.tar.gz
puppet-8d0ca9f823da75722bc542725c4753d7168bbd21.tar.bz2
puppet-8d0ca9f823da75722bc542725c4753d7168bbd21.tar.xz
puppet-8d0ca9f823da75722bc542725c4753d7168bbd21.zip
- do not let user change their own memberOf attribute, ( even if the overlay may prevent it )
Diffstat (limited to 'modules/openldap')
-rw-r--r--modules/openldap/templates/mandriva-dit-access.conf7
1 files changed, 6 insertions, 1 deletions
diff --git a/modules/openldap/templates/mandriva-dit-access.conf b/modules/openldap/templates/mandriva-dit-access.conf
index 044eb212..aac4d32e 100644
--- a/modules/openldap/templates/mandriva-dit-access.conf
+++ b/modules/openldap/templates/mandriva-dit-access.conf
@@ -113,10 +113,15 @@ access to dn.subtree="ou=People,<%= dc_suffix %>"
# let the user change some of his/her attributes
access to dn.subtree="ou=People,<%= dc_suffix %>"
- attrs=carLicense,homePhone,homePostalAddress,mobile,pager,telephoneNumber,mail,preferredLanguage,sshPublicKey,memberOf
+ attrs=carLicense,homePhone,homePostalAddress,mobile,pager,telephoneNumber,mail,preferredLanguage,sshPublicKey
by self write
by users read
+access to dn.subtree="ou=People,<%= dc_suffix %>"
+ attrs=memberOf
+ by users read
+
+
# create new accounts
access to dn.regex="^([^,]+,)?ou=(People|Group|Hosts),<%= dc_suffix %>$"
attrs=children,entry