foo.sh/ansible
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

configure authz mappings for gssapi authenticated users

Browse source
This commit is contained in:
Timo Makinen 2019-06-06 01:54:54 +03:00
parent 1979925f7e
commit 11e4a82a35
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
roles/ldap/server/templates/slapd.conf.j2
View file

@ -94,10 +94,15 @@ authz-regexp
authz-regexp authz-regexp
"gidNumber=([0-9]\+)\\\+uidNumber=([0-9]\+),cn=peercred,cn=external,cn=auth" "gidNumber=([0-9]\+)\\\+uidNumber=([0-9]\+),cn=peercred,cn=external,cn=auth"
"ldap:///{{ ldap_basedn }}??sub?(&(uidNumber=$2)(objectClass=posixAccount))" "ldap:///{{ ldap_basedn }}??sub?(&(uidNumber=$2)(objectClass=posixAccount))"
# map kerberos users
authz-regexp
"uid=([^,]\+),cn=gssapi,cn=auth"
"ldap:///{{ ldap_basedn }}??sub?(&(uid=$1)(objectClass=posixAccount))"
# require authentication for authenticated users that don't match above # require authentication for authenticated users that don't match above
access to * access to *
by dn.children="cn=peercred,cn=external,cn=auth" auth by dn.children="cn=peercred,cn=external,cn=auth" auth
by dn.children="cn=gssapi,cn=auth" auth
by anonymous auth by anonymous auth
by * break by * break